cups/patches/cups-1.2.12-CVE-2007-5849.patch

diff -Naur cups-1.3.4/backend/snmp.c cups-1.3.4.new/backend/snmp.c
--- cups-1.3.4/backend/snmp.c	2007-07-11 23:46:42.000000000 +0200
+++ cups-1.3.4.new/backend/snmp.c	2007-12-10 12:56:12.680574919 +0100
@@ -1064,18 +1064,38 @@
     char          *string,		/* I  - String buffer */
     int           strsize)		/* I  - String buffer size */
 {
-  if (length < strsize)
+  if (length < 0)
   {
-    memcpy(string, *buffer, length);
+   /*
+    * Disallow negative lengths!
+    */
+
+    fprintf(stderr, "ERROR: Bad ASN1 string length %d!\n", length);
+    *string = '\0';
+  }
+  else if (length < strsize)
+  {
+   /*
+    * String is smaller than the buffer...
+    */
+
+    if (length > 0)
+      memcpy(string, *buffer, length);
+
     string[length] = '\0';
   }
   else
   {
+   /*
+    * String is larger than the buffer...
+    */
+
     memcpy(string, buffer, strsize - 1);
     string[strsize - 1] = '\0';
   }
 
-  (*buffer) += length;
+  if (length > 0)
+    (*buffer) += length;
 
   return (string);
 }
1	niro	435	diff -Naur cups-1.3.4/backend/snmp.c cups-1.3.4.new/backend/snmp.c
2			--- cups-1.3.4/backend/snmp.c 2007-07-11 23:46:42.000000000 +0200
3			+++ cups-1.3.4.new/backend/snmp.c 2007-12-10 12:56:12.680574919 +0100
4			@@ -1064,18 +1064,38 @@
5			char string, / I - String buffer */
6			int strsize) /* I - String buffer size */
7			{
8			- if (length < strsize)
9			+ if (length < 0)
10			{
11			- memcpy(string, *buffer, length);
12			+ /*
13			+ * Disallow negative lengths!
14			+ */
15			+
16			+ fprintf(stderr, "ERROR: Bad ASN1 string length %d!\n", length);
17			+ *string = '\0';
18			+ }
19			+ else if (length < strsize)
20			+ {
21			+ /*
22			+ * String is smaller than the buffer...
23			+ */
24			+
25			+ if (length > 0)
26			+ memcpy(string, *buffer, length);
27			+
28			string[length] = '\0';
29			}
30			else
31			{
32			+ /*
33			+ * String is larger than the buffer...
34			+ */
35			+
36			memcpy(string, buffer, strsize - 1);
37			string[strsize - 1] = '\0';
38			}
39
40			- (*buffer) += length;
41			+ if (length > 0)
42			+ (*buffer) += length;
43
44			return (string);
45			}