From 8c10923cc29e697f5c87ff5a20c4f46a21f25e30 Mon Sep 17 00:00:00 2001 From: Bram Yu Date: Sat, 17 Jan 2026 16:20:56 +0800 Subject: [PATCH 1/2] Fix a bug that may cut the IPP->attrs link list --- cups/ipp.c | 28 ++++++++++------------------ 1 file changed, 10 insertions(+), 18 deletions(-) diff --git a/cups/ipp.c b/cups/ipp.c index eed8c09a4..0fdb2cce4 100644 --- a/cups/ipp.c +++ b/cups/ipp.c @@ -5954,25 +5954,17 @@ ipp_set_value(ipp_t *ipp, // IO - IPP message #endif // !__clang_analyzer__ DEBUG_printf("4debug_alloc: %p %s %s%s (%u)", (void *)temp, temp->name, temp->num_values > 1 ? "1setOf " : "", ippTagString(temp->value_tag), (unsigned)temp->num_values); - if (ipp->current == *attr && ipp->prev) - { - // Use current "previous" pointer... - prev = ipp->prev; - } - else - { - // Find this attribute in the linked list... - for (prev = NULL, current = ipp->attrs; current && current != *attr; prev = current, current = current->next) - ; // Loop until we find the attribute + // Find this attribute in the linked list... + for (prev = NULL, current = ipp->attrs; current && current != *attr; prev = current, current = current->next) + ; // Loop until we find the attribute - if (!current) - { - // This is a serious error! - *attr = temp; - _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("IPP attribute is not a member of the message."), true); - DEBUG_puts("4ipp_set_value: Unable to find attribute in message."); - return (NULL); - } + if (!current) + { + // This is a serious error! + *attr = temp; + _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("IPP attribute is not a member of the message."), true); + DEBUG_puts("4ipp_set_value: Unable to find attribute in message."); + return (NULL); } if (prev) From a4f9617ba35c2b8d9a5d0fd6894228e2f8fa4fe5 Mon Sep 17 00:00:00 2001 From: bt-life Date: Mon, 19 Jan 2026 20:01:45 +0800 Subject: [PATCH 2/2] Revert "Fix a bug that may cut the IPP->attrs link list" This reverts commit 8c10923cc29e697f5c87ff5a20c4f46a21f25e30. --- cups/ipp.c | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-) diff --git a/cups/ipp.c b/cups/ipp.c index 0fdb2cce4..eed8c09a4 100644 --- a/cups/ipp.c +++ b/cups/ipp.c @@ -5954,17 +5954,25 @@ ipp_set_value(ipp_t *ipp, // IO - IPP message #endif // !__clang_analyzer__ DEBUG_printf("4debug_alloc: %p %s %s%s (%u)", (void *)temp, temp->name, temp->num_values > 1 ? "1setOf " : "", ippTagString(temp->value_tag), (unsigned)temp->num_values); - // Find this attribute in the linked list... - for (prev = NULL, current = ipp->attrs; current && current != *attr; prev = current, current = current->next) - ; // Loop until we find the attribute - - if (!current) + if (ipp->current == *attr && ipp->prev) { - // This is a serious error! - *attr = temp; - _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("IPP attribute is not a member of the message."), true); - DEBUG_puts("4ipp_set_value: Unable to find attribute in message."); - return (NULL); + // Use current "previous" pointer... + prev = ipp->prev; + } + else + { + // Find this attribute in the linked list... + for (prev = NULL, current = ipp->attrs; current && current != *attr; prev = current, current = current->next) + ; // Loop until we find the attribute + + if (!current) + { + // This is a serious error! + *attr = temp; + _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("IPP attribute is not a member of the message."), true); + DEBUG_puts("4ipp_set_value: Unable to find attribute in message."); + return (NULL); + } } if (prev)