diff -up cups-1.4.4/cups/ipp.c.CVE-2010-2941 cups-1.4.4/cups/ipp.c

--- cups-1.4.4/cups/ipp.c.CVE-2010-2941	2010-04-23 19:56:34.000000000 +0100

+++ cups-1.4.4/cups/ipp.c	2010-11-11 11:30:28.566745595 +0000

@@ -1275,7 +1275,9 @@ ippReadIO(void       *src,		/* I - Data 

 	      attr->value_tag = tag;

 	    }

-	    else if ((value_tag >= IPP_TAG_TEXTLANG &&

+	    else if (value_tag == IPP_TAG_TEXTLANG ||

+	             value_tag == IPP_TAG_NAMELANG ||

+		     (value_tag >= IPP_TAG_TEXT &&

 		      value_tag <= IPP_TAG_MIMETYPE))

             {

 	     /*

@@ -1283,8 +1285,9 @@ ippReadIO(void       *src,		/* I - Data 

 	      * forms; accept sets of differing values...

 	      */

-	      if ((tag < IPP_TAG_TEXTLANG || tag > IPP_TAG_MIMETYPE) &&

-	          tag != IPP_TAG_NOVALUE)

+	      if (tag != IPP_TAG_TEXTLANG && tag != IPP_TAG_NAMELANG &&

+	          (tag < IPP_TAG_TEXT || tag > IPP_TAG_MIMETYPE) &&

+		  tag != IPP_TAG_NOVALUE)

 	      {

 		DEBUG_printf(("1ippReadIO: 1setOf value tag %x(%s) != %x(%s)",

 			      value_tag, ippTagString(value_tag), tag,

@@ -2766,6 +2769,7 @@ _ippFreeAttr(ipp_attribute_t *attr)	/* I

   {

     case IPP_TAG_TEXT :

     case IPP_TAG_NAME :

+    case IPP_TAG_RESERVED_STRING :

     case IPP_TAG_KEYWORD :

     case IPP_TAG_URI :

     case IPP_TAG_URISCHEME :

diff -up cups-1.4.4/cups/ipp.h.CVE-2010-2941 cups-1.4.4/cups/ipp.h

--- cups-1.4.4/cups/ipp.h.CVE-2010-2941	2010-04-23 19:56:34.000000000 +0100

+++ cups-1.4.4/cups/ipp.h	2010-11-11 11:30:28.568745537 +0000

@@ -93,7 +93,8 @@ typedef enum ipp_tag_e			/**** Format ta

   IPP_TAG_END_COLLECTION,		/* End of collection value */

   IPP_TAG_TEXT = 0x41,			/* Text value */

   IPP_TAG_NAME,				/* Name value */

-  IPP_TAG_KEYWORD = 0x44,		/* Keyword value */

+  IPP_TAG_RESERVED_STRING,		/* Reserved for future string value @private@ */

+  IPP_TAG_KEYWORD,			/* Keyword value */

   IPP_TAG_URI,				/* URI value */

   IPP_TAG_URISCHEME,			/* URI scheme value */

   IPP_TAG_CHARSET,			/* Character set value */