CVE-2019-2228: Fix ippSetValueTag validation of default language.

apple · Dec 13, 2019 · b018978 · b018978
1 parent bb64028
commit b018978
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/CHANGES.md b/CHANGES.md
@@ -1,11 +1,13 @@
-CHANGES - 2.3.1 - 2019-12-04
+CHANGES - 2.3.1 - 2019-12-13
 ============================
 
 
 Changes in CUPS v2.3.1
 ----------------------
 
 - Documentation updates (Issue #5661, #5674, #5682)
+- CVE-2019-2228: The `ippSetValuetag` function did not validate the default
+ language value.
 - Fixed a crash bug in the web interface (Issue #5621)
 - The PPD cache code now looks up page sizes using their dimensions
  (Issue #5633)

diff --git a/cups/ipp.c b/cups/ipp.c
@@ -4565,7 +4565,7 @@ ippSetValueTag(
  return (0);
 
  if (ipp->attrs && ipp->attrs->next && ipp->attrs->next->name &&
- !strcmp(ipp->attrs->next->name, "attributes-natural-language"))
+ !strcmp(ipp->attrs->next->name, "attributes-natural-language") && (ipp->attrs->next->value_tag & IPP_TAG_CUPS_MASK) == IPP_TAG_LANGUAGE)
  {
  /*
  * Use the language code from the IPP message...