From: Michael R Sweet <msweet@msweet.org>
Date: Sun, 5 Apr 2026 14:59:49 +0000 (-0400)
Subject: Fix parsing bug in cgiCheckVariables.
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=44ac013d2a07fd189dc1890a8951ee553b8347e2;p=thirdparty%2Fcups.git

Fix parsing bug in cgiCheckVariables.
---

diff --git a/cgi-bin/var.c b/cgi-bin/var.c
index e5443499d5..f251aa173a 100644
--- a/cgi-bin/var.c
+++ b/cgi-bin/var.c
@@ -1,7 +1,7 @@
 /*
  * CGI form variable and array functions for CUPS.
  *
- * Copyright © 2020-2025 by OpenPrinting.
+ * Copyright © 2020-2026 by OpenPrinting.
  * Copyright © 2007-2019 by Apple Inc.
  * Copyright © 1997-2005 by Easy Software Products.
  *
@@ -88,8 +88,11 @@ cgiCheckVariables(const char *names)	/* I - Variables to look for */
     while (*names == ' ' || *names == ',')
       names ++;
 
-    for (s = name; *names != '\0' && *names != ' ' && *names != ','; s ++, names ++)
-      *s = *names;
+    for (s = name; *names != '\0' && *names != ' ' && *names != ','; names ++)
+    {
+      if (s < (name + sizeof(name) - 1))
+        *s++ = *names;
+    }
 
     *s = 0;
     if (name[0] == '\0')