diff options
| author | Sean Kau <skau@chromium.org> | 2019-12-04 10:19:18 -0800 |
|---|---|---|
| committer | Sean Kau <skau@chromium.org> | 2019-12-04 10:35:33 -0800 |
| commit | a00d9eaecfbaba8b78d063d2460b81f1516989b6 (patch) | |
| tree | 12695c970334432669fb54c6de5a2e6bd5949366 /cups | |
| parent | f9373221543b41ccc761ce06f09ae1985c1a8aed (diff) | |
| download | cups-a00d9eaecfbaba8b78d063d2460b81f1516989b6.tar.gz | |
Off by one error in ipp_finishings_vendor
When enumvalue is 101 and attrname is "finsishings-supported"
we were getting the memory after ipp_finishings_vendor
in the ipp_job_collation_types array.
Diffstat (limited to 'cups')
| -rw-r--r-- | cups/ipp-support.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/cups/ipp-support.c b/cups/ipp-support.c index 192f5b6b8..bfb9dff09 100644 --- a/cups/ipp-support.c +++ b/cups/ipp-support.c @@ -2093,7 +2093,7 @@ ippEnumString(const char *attrname, /* I - Attribute name */ { if (enumvalue >= 3 && enumvalue < (3 + (int)(sizeof(ipp_finishings) / sizeof(ipp_finishings[0])))) return (ipp_finishings[enumvalue - 3]); - else if (enumvalue >= 0x40000000 && enumvalue <= (0x40000000 + (int)(sizeof(ipp_finishings_vendor) / sizeof(ipp_finishings_vendor[0])))) + else if (enumvalue >= 0x40000000 && enumvalue < (0x40000000 + (int)(sizeof(ipp_finishings_vendor) / sizeof(ipp_finishings_vendor[0])))) return (ipp_finishings_vendor[enumvalue - 0x40000000]); } else if ((!strcmp(attrname, "job-collation-type") || !strcmp(attrname, "job-collation-type-actual")) && enumvalue >= 3 && enumvalue < (3 + (int)(sizeof(ipp_job_collation_types) / sizeof(ipp_job_collation_types[0])))) |