From 5de0158461a93ec9eb3f18736a904982d9a0f6b6 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <msweet@msweet.org>
Date: Mon, 25 Mar 2024 18:33:34 -0400
Subject: [PATCH] Fix encoding of extension values (Issue #913)

---
 CHANGES.md |  1 +
 cups/ipp.c | 51 +++++++++++++++------------------------------------
 cups/ipp.h |  2 +-
 3 files changed, 17 insertions(+), 37 deletions(-)

diff --git a/CHANGES.md b/CHANGES.md
index 1ae376fd49..bb99b129bd 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -59,6 +59,7 @@ Changes in CUPS v2.5b1 (TBA)
 - Fixed Oki 407 freeze when printing larger jobs (Issue #877)
 - Fixed checking for required attributes during PPD generation (Issue #890)
 - Fixed encoding of IPv6 addresses in HTTP requests (Issue #903)
+- Fixed encoding of `IPP_TAG_EXTENSION` values in IPP messages (Issue #913)
 - Removed hash support for SHA2-512-224 and SHA2-512-256.
 - Removed `mantohtml` script for generating html pages (use
   `https://www.msweet.org/mantohtml/`)
diff --git a/cups/ipp.c b/cups/ipp.c
index 09e4d35d2b..6e1d9cf1c8 100644
--- a/cups/ipp.c
+++ b/cups/ipp.c
@@ -2139,7 +2139,7 @@ ippGetOctetString(
     int             *datalen)		// O - Length of octetString data
 {
   // Range check input...
-  if (!attr || attr->value_tag != IPP_TAG_STRING || element < 0 || element >= attr->num_values)
+  if (!attr || (attr->value_tag != IPP_TAG_STRING && attr->value_tag != IPP_TAG_EXTENSION) || element < 0 || element >= attr->num_values)
   {
     if (datalen)
       *datalen = 0;
@@ -2669,25 +2669,6 @@ ippReadIO(void        *src,		// I - Data source
 
 	  // Read this attribute...
           tag = (ipp_tag_t)buffer[0];
-          if (tag == IPP_TAG_EXTENSION)
-          {
-            // Read 32-bit "extension" tag...
-	    if ((*cb)(src, buffer, 4) < 4)
-	    {
-	      DEBUG_puts("1ippReadIO: Callback returned EOF/error");
-	      goto rollback;
-	    }
-
-	    tag = (ipp_tag_t)((buffer[0] << 24) | (buffer[1] << 16) | (buffer[2] << 8) | buffer[3]);
-
-            if (tag & IPP_TAG_CUPS_CONST)
-            {
-              // Fail if the high bit is set in the tag...
-	      _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("IPP extension tag larger than 0x7FFFFFFF."), 1);
-	      DEBUG_printf("1ippReadIO: bad tag 0x%x.", tag);
-	      goto rollback;
-            }
-          }
 
 	  if (tag == IPP_TAG_END)
 	  {
@@ -3507,7 +3488,7 @@ ippSetOctetString(
 
 
   // Range check input...
-  if (!ipp || !attr || !*attr || ((*attr)->value_tag != IPP_TAG_STRING && (*attr)->value_tag != IPP_TAG_NOVALUE && (*attr)->value_tag != IPP_TAG_UNKNOWN) || element < 0 || element > (*attr)->num_values || datalen < 0 || datalen > IPP_MAX_LENGTH)
+  if (!ipp || !attr || !*attr || ((*attr)->value_tag != IPP_TAG_STRING && (*attr)->value_tag != IPP_TAG_NOVALUE && (*attr)->value_tag != IPP_TAG_UNKNOWN && (*attr)->value_tag != IPP_TAG_EXTENSION) || element < 0 || element > (*attr)->num_values || datalen < 0 || datalen > IPP_MAX_LENGTH)
     return (0);
 
   // Set the value and return...
@@ -4090,6 +4071,16 @@ ippSetValueTag(
         if (temp_tag == IPP_TAG_NAME || temp_tag == IPP_TAG_NAMELANG)
           break;			// Silently "allow" name -> keyword
 
+        return (0);
+
+    case IPP_TAG_EXTENSION :
+        if (temp_tag == IPP_TAG_STRING && value_tag == IPP_TAG_EXTENSION)
+        {
+          // Allow octetString -> extension
+          (*attr)->value_tag = value_tag;
+          break;
+        }
+
     default :
         return (0);
   }
@@ -4866,22 +4857,10 @@ ippWriteIO(void        *dst,		// I - Destination
 	    }
 
             // Write the value tag, name length, and name string...
-            DEBUG_printf("2ippWriteIO: writing value tag=%x(%s)", attr->value_tag, ippTagString(attr->value_tag));
-            DEBUG_printf("2ippWriteIO: writing name=%d,\"%s\"", n, attr->name);
-
-            if (attr->value_tag > 0xff)
-            {
-              *bufptr++ = IPP_TAG_EXTENSION;
-	      *bufptr++ = (ipp_uchar_t)(attr->value_tag >> 24);
-	      *bufptr++ = (ipp_uchar_t)(attr->value_tag >> 16);
-	      *bufptr++ = (ipp_uchar_t)(attr->value_tag >> 8);
-	      *bufptr++ = (ipp_uchar_t)attr->value_tag;
-            }
-            else
-            {
-	      *bufptr++ = (ipp_uchar_t)attr->value_tag;
-	    }
+	    DEBUG_printf("2ippWriteIO: writing value tag=%x(%s)", attr->value_tag, ippTagString(attr->value_tag));
+	    DEBUG_printf("2ippWriteIO: writing name=%d,\"%s\"", n, attr->name);
 
+	    *bufptr++ = (ipp_uchar_t)attr->value_tag;
 	    *bufptr++ = (ipp_uchar_t)(n >> 8);
 	    *bufptr++ = (ipp_uchar_t)n;
 	    memcpy(bufptr, attr->name, (size_t)n);
diff --git a/cups/ipp.h b/cups/ipp.h
index b4bc1da940..891b1a4ca0 100644
--- a/cups/ipp.h
+++ b/cups/ipp.h
@@ -493,7 +493,7 @@ typedef enum ipp_tag_e			// Value and group tag values for attributes
   IPP_TAG_LANGUAGE,			// Language value
   IPP_TAG_MIMETYPE,			// MIME media type value
   IPP_TAG_MEMBERNAME,			// Collection member name value @exclude all@
-  IPP_TAG_EXTENSION = 0x7f,		// Extension point for 32-bit tags @exclude all@
+  IPP_TAG_EXTENSION = 0x7f,		// Extension point for 32-bit tags (part of value)
   IPP_TAG_CUPS_MASK = 0x7fffffff,	// Mask for copied attribute values @private@
   // The following expression is used to avoid compiler warnings with +/-0x80000000
   IPP_TAG_CUPS_CONST = -0x7fffffff-1	// Bitflag for copied/const attribute values @private@
-- 
2.47.2