From b893480c2ab5dca4d83ee3860711e08c7c2d7486 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Sun, 28 Mar 2021 20:57:55 -0400
Subject: [PATCH] Protect against group tags inside collections.

---
 cups/ipp.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/cups/ipp.c b/cups/ipp.c
index 5f5b7922c3..3a341f2175 100644
--- a/cups/ipp.c
+++ b/cups/ipp.c
@@ -3004,7 +3004,14 @@ ippReadIO(void       *src,		/* I - Data source */
 	    * Group tag...  Set the current group and continue...
 	    */
 
-            if (ipp->curtag == tag)
+            if (parent)
+            {
+	      _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Invalid group tag."), 1);
+	      DEBUG_printf(("1ippReadIO: bad tag 0x%02x.", tag));
+	      _cupsBufferRelease((char *)buffer);
+	      return (IPP_STATE_ERROR);
+            }
+            else if (ipp->curtag == tag)
 	      ipp->prev = ippAddSeparator(ipp);
             else if (ipp->current)
 	      ipp->prev = ipp->current;
-- 
2.47.2