$NetBSD: patch-ar,v 1.4.2.2 2010/11/13 11:22:03 tron Exp $

Add str3648.patch by Mike Sweet to address CVE-2010-2941.
Obtained from https://bugzilla.redhat.com/show_bug.cgi?id=624438
as Cups STR#3648 (http://www.cups.org/str.php?L3648) is not public yet!

--- cups/ipp.c.orig	2010-04-23 18:56:34.000000000 +0000
+++ cups/ipp.c
@@ -1275,7 +1275,9 @@ ippReadIO(void       *src,		/* I - Data
 
 	      attr->value_tag = tag;
 	    }
-	    else if ((value_tag >= IPP_TAG_TEXTLANG &&
+	    else if (value_tag == IPP_TAG_TEXTLANG ||
+	             value_tag == IPP_TAG_NAMELANG ||
+		     (value_tag >= IPP_TAG_TEXT &&
 		      value_tag <= IPP_TAG_MIMETYPE))
             {
 	     /*
@@ -1283,8 +1285,9 @@ ippReadIO(void       *src,		/* I - Data
 	      * forms; accept sets of differing values...
 	      */
 
-	      if ((tag < IPP_TAG_TEXTLANG || tag > IPP_TAG_MIMETYPE) &&
-	          tag != IPP_TAG_NOVALUE)
+	      if (tag != IPP_TAG_TEXTLANG && tag != IPP_TAG_NAMELANG &&
+	          (tag < IPP_TAG_TEXT || tag > IPP_TAG_MIMETYPE) &&
+		  tag != IPP_TAG_NOVALUE)
 	      {
 		DEBUG_printf(("1ippReadIO: 1setOf value tag %x(%s) != %x(%s)",
 			      value_tag, ippTagString(value_tag), tag,
@@ -2766,6 +2769,7 @@ _ippFreeAttr(ipp_attribute_t *attr)	/* I
   {
     case IPP_TAG_TEXT :
     case IPP_TAG_NAME :
+    case IPP_TAG_RESERVED_STRING :
     case IPP_TAG_KEYWORD :
     case IPP_TAG_URI :
     case IPP_TAG_URISCHEME :
