52d3a4
diff -up cups-1.4.6/backend/ieee1284.c.usb-parallel cups-1.4.6/backend/ieee1284.c
52d3a4
--- cups-1.4.6/backend/ieee1284.c.usb-parallel	2010-04-10 00:42:09.000000000 +0200
52d3a4
+++ cups-1.4.6/backend/ieee1284.c	2011-02-01 16:13:44.000000000 +0100
52d3a4
@@ -55,7 +55,7 @@ backendGetDeviceID(
52d3a4
 #  if defined(__sun) && defined(ECPPIOC_GETDEVID)
52d3a4
   struct ecpp_device_id did;		/* Device ID buffer */
52d3a4
 #  endif /* __sun && ECPPIOC_GETDEVID */
52d3a4
-
52d3a4
+  char  *c;
52d3a4
 
52d3a4
   DEBUG_printf(("backendGetDeviceID(fd=%d, device_id=%p, device_id_size=%d, "
52d3a4
                 "make_model=%p, make_model_size=%d, scheme=\"%s\", "
52d3a4
@@ -176,7 +176,7 @@ backendGetDeviceID(
52d3a4
       * and then limit the length to the size of our buffer...
52d3a4
       */
52d3a4
 
52d3a4
-      if (length > device_id_size)
52d3a4
+      if ((length > device_id_size) || (length < 14))
52d3a4
 	length = (((unsigned)device_id[1] & 255) << 8) +
52d3a4
 		 ((unsigned)device_id[0] & 255);
52d3a4
 
52d3a4
@@ -214,11 +214,16 @@ backendGetDeviceID(
52d3a4
 	device_id[length] = '\0';
52d3a4
       }
52d3a4
     }
52d3a4
-#    ifdef DEBUG
52d3a4
     else
52d3a4
+    {
52d3a4
+#    ifdef DEBUG
52d3a4
+
52d3a4
       DEBUG_printf(("backendGetDeviceID: ioctl failed - %s\n",
52d3a4
                     strerror(errno)));
52d3a4
 #    endif /* DEBUG */
52d3a4
+      /* Clean up after failed attempt to get device ID */
52d3a4
+      *device_id = '\0';
52d3a4
+    }
52d3a4
 #  endif /* __linux */
52d3a4
 
52d3a4
 #   if defined(__sun) && defined(ECPPIOC_GETDEVID)
52d3a4
@@ -246,14 +251,24 @@ backendGetDeviceID(
52d3a4
 #  endif /* __sun && ECPPIOC_GETDEVID */
52d3a4
   }
52d3a4
 
52d3a4
+ /*
52d3a4
+  * Check whether device ID is valid. Turn line breaks and tabs to spaces
52d3a4
+  * and abort device IDs with non-printable characters
52d3a4
+  */
52d3a4
+  for (c = device_id; *c; c++)
52d3a4
+    if (isspace(*c))
52d3a4
+      *c = ' ';
52d3a4
+    else if (!isprint(*c))
52d3a4
+    {
52d3a4
+      *device_id = '\0';
52d3a4
+      break;
52d3a4
+    }
52d3a4
+
52d3a4
   DEBUG_printf(("backendGetDeviceID: device_id=\"%s\"\n", device_id));
52d3a4
 
52d3a4
   if (scheme && uri)
52d3a4
     *uri = '\0';
52d3a4
 
52d3a4
-  if (!*device_id)
52d3a4
-    return (-1);
52d3a4
-
52d3a4
  /*
52d3a4
   * Get the make and model...
52d3a4
   */