From d9f301dd149477803d806414bed14d0d75910eea Mon Sep 17 00:00:00 2001 From: Michael R Sweet Date: Tue, 5 Feb 2019 12:02:49 -0500 Subject: [PATCH] Fix UTF-8 validation (Issue #5509) --- CHANGES.md | 4 +++- cups/ipp.c | 48 ++++++++++++++++++------------------------------ 2 files changed, 21 insertions(+), 31 deletions(-) diff --git a/CHANGES.md b/CHANGES.md index 65915d44cd..5f72f68eac 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -1,4 +1,4 @@ -CHANGES - 2.3b8 - 2019-01-24 +CHANGES - 2.3b8 - 2019-02-05 ============================ @@ -7,6 +7,8 @@ Changes in CUPS v2.3b8 - Fixed a potential crash bug in cups-driverd (rdar://46625579) - Fixed a performance regression with large PPDs (rdar://47040759) +- The `ippValidateAttribute` function did not catch all instances of invalid + UTF-8 strings (Issue #5509) - Fixed a potential memory leak when reading at the end of a file (Issue #5473) - Fixed potential unaligned accesses in the string pool (Issue #5474) - Fixed a potential memory leak when loading a PPD file (Issue #5475) diff --git a/cups/ipp.c b/cups/ipp.c index cc720d2220..0248cb9d29 100644 --- a/cups/ipp.c +++ b/cups/ipp.c @@ -4909,30 +4909,24 @@ ippValidateAttribute( { if ((*ptr & 0xe0) == 0xc0) { - ptr ++; - if ((*ptr & 0xc0) != 0x80) + if ((ptr[1] & 0xc0) != 0x80) break; + + ptr ++; } else if ((*ptr & 0xf0) == 0xe0) { - ptr ++; - if ((*ptr & 0xc0) != 0x80) - break; - ptr ++; - if ((*ptr & 0xc0) != 0x80) + if ((ptr[1] & 0xc0) != 0x80 || (ptr[2] & 0xc0) != 0x80) break; + + ptr += 2; } else if ((*ptr & 0xf8) == 0xf0) { - ptr ++; - if ((*ptr & 0xc0) != 0x80) - break; - ptr ++; - if ((*ptr & 0xc0) != 0x80) - break; - ptr ++; - if ((*ptr & 0xc0) != 0x80) + if ((ptr[1] & 0xc0) != 0x80 || (ptr[2] & 0xc0) != 0x80 || (ptr[3] & 0xc0) != 0x80) break; + + ptr += 3; } else if (*ptr & 0x80) break; @@ -4970,30 +4964,24 @@ ippValidateAttribute( { if ((*ptr & 0xe0) == 0xc0) { - ptr ++; - if ((*ptr & 0xc0) != 0x80) + if ((ptr[1] & 0xc0) != 0x80) break; + + ptr ++; } else if ((*ptr & 0xf0) == 0xe0) { - ptr ++; - if ((*ptr & 0xc0) != 0x80) - break; - ptr ++; - if ((*ptr & 0xc0) != 0x80) + if ((ptr[1] & 0xc0) != 0x80 || (ptr[2] & 0xc0) != 0x80) break; + + ptr += 2; } else if ((*ptr & 0xf8) == 0xf0) { - ptr ++; - if ((*ptr & 0xc0) != 0x80) - break; - ptr ++; - if ((*ptr & 0xc0) != 0x80) - break; - ptr ++; - if ((*ptr & 0xc0) != 0x80) + if ((ptr[1] & 0xc0) != 0x80 || (ptr[2] & 0xc0) != 0x80 || (ptr[3] & 0xc0) != 0x80) break; + + ptr += 3; } else if (*ptr & 0x80) break; -- 2.47.2