diff -up foomatic-filters-4.0.7/foomaticrip.c.CVE-2011-2697 foomatic-filters-4.0.7/foomaticrip.c
--- foomatic-filters-4.0.7/foomaticrip.c.CVE-2011-2697	2011-07-20 10:41:15.825401233 +0100
+++ foomatic-filters-4.0.7/foomaticrip.c	2011-07-20 10:42:22.784101806 +0100
@@ -1239,8 +1239,11 @@ int main(int argc, char** argv)
     }
 
     /* Check for LPRng first so we do not pick up bogus ppd files by the -ppd option */
-    if (arglist_remove_flag(arglist, "--lprng"))
-        spooler = SPOOLER_LPRNG;
+    if (spooler != SPOOLER_CUPS && spooler != SPOOLER_PPR && 
+	spooler != SPOOLER_PPR_INT) {
+        if (arglist_remove_flag(arglist, "--lprng"))
+            spooler = SPOOLER_LPRNG;
+    }
 
     /* 'PRINTCAP_ENTRY' environment variable is : LPRng
        the :ppd=/path/to/ppdfile printcap entry should be used */
@@ -1262,96 +1265,104 @@ int main(int argc, char** argv)
         }
     }
 
-    /* PPD file name given via the command line
-       allow duplicates, and use the last specified one */
-    if (spooler != SPOOLER_LPRNG) {
-        while ((str = arglist_get_value(arglist, "-p"))) {
-            strncpy(job->ppdfile, str, 256);
-            arglist_remove(arglist, "-p");
-        }
-    }
-    while ((str = arglist_get_value(arglist, "--ppd"))) {
-        strncpy(job->ppdfile, str, 256);
-        arglist_remove(arglist, "--ppd");
-    }
-
-    /* Check for LPD/GNUlpr by typical options which the spooler puts onto
-       the filter's command line (options "-w": text width, "-l": text
-       length, "-i": indent, "-x", "-y": graphics size, "-c": raw printing,
-       "-n": user name, "-h": host name) */
-    if ((str = arglist_get_value(arglist, "-h"))) {
-        if (spooler != SPOOLER_GNULPR && spooler != SPOOLER_LPRNG)
-            spooler = SPOOLER_LPD;
-        strncpy(job->host, str, 127);
-        job->host[127] = '\0';
-        arglist_remove(arglist, "-h");
-    }
-    if ((str = arglist_get_value(arglist, "-n"))) {
-        if (spooler != SPOOLER_GNULPR && spooler != SPOOLER_LPRNG)
-            spooler = SPOOLER_LPD;
-
-        strncpy(job->user, str, 127);
-        job->user[127] = '\0';
-        arglist_remove(arglist, "-n");
-    }
-    if (arglist_remove(arglist, "-w") ||
-        arglist_remove(arglist, "-l") ||
-        arglist_remove(arglist, "-x") ||
-        arglist_remove(arglist, "-y") ||
-        arglist_remove(arglist, "-i") ||
-        arglist_remove_flag(arglist, "-c")) {
+    /* CUPS calls foomatic-rip only with 5 or 6 positional parameters,
+       not with named options, like for example "-p <string>". Also PPR
+       does not used named options. */
+    if (spooler != SPOOLER_CUPS && spooler != SPOOLER_PPR && 
+	spooler != SPOOLER_PPR_INT) {
+        /* Check for LPD/GNUlpr by typical options which the spooler puts onto
+           the filter's command line (options "-w": text width, "-l": text
+           length, "-i": indent, "-x", "-y": graphics size, "-c": raw printing,
+           "-n": user name, "-h": host name) */
+        if ((str = arglist_get_value(arglist, "-h"))) {
+            if (spooler != SPOOLER_GNULPR && spooler != SPOOLER_LPRNG)
+                spooler = SPOOLER_LPD;
+            strncpy(job->host, str, 127);
+            job->host[127] = '\0';
+            arglist_remove(arglist, "-h");
+        }
+        if ((str = arglist_get_value(arglist, "-n"))) {
             if (spooler != SPOOLER_GNULPR && spooler != SPOOLER_LPRNG)
                 spooler = SPOOLER_LPD;
-    }
-    /* LPRng delivers the option settings via the "-Z" argument */
-    if ((str = arglist_get_value(arglist, "-Z"))) {
-        spooler = SPOOLER_LPRNG;
-        dstrcatf(job->optstr, "%s ", str);
-        arglist_remove(arglist, "-Z");
-    }
-    /* Job title and options for stock LPD */
-    if ((str = arglist_get_value(arglist, "-j")) || (str = arglist_get_value(arglist, "-J"))) {
-        strncpy_omit(job->title, str, 128, omit_shellescapes);
-        if (spooler == SPOOLER_LPD)
-             dstrcatf(job->optstr, "%s ", job->title);
-         if (!arglist_remove(arglist, "-j"))
-            arglist_remove(arglist, "-J");
-    }
-    /* Check for CPS */
-    if (arglist_remove_flag(arglist, "--cps") > 0)
-        spooler = SPOOLER_CPS;
-
-    /* Options for spooler-less printing, CPS, or PDQ */
-    while ((str = arglist_get_value(arglist, "-o"))) {
-        strncpy_omit(tmp, str, 1024, omit_shellescapes);
-        dstrcatf(job->optstr, "%s ", tmp);
-        arglist_remove(arglist, "-o");
-        /* If we don't print as PPR RIP or as CPS filter, we print
-           without spooler (we check for PDQ later) */
-        if (spooler != SPOOLER_PPR && spooler != SPOOLER_CPS)
-            spooler = SPOOLER_DIRECT;
-    }
-
-    /* Printer for spooler-less printing or PDQ */
-    if ((str = arglist_get_value(arglist, "-d"))) {
-        strncpy_omit(job->printer, str, 256, omit_shellescapes);
-        arglist_remove(arglist, "-d");
-    }
-
-    /* Printer for spooler-less printing, PDQ, or LPRng */
-    if ((str = arglist_get_value(arglist, "-P"))) {
-        strncpy_omit(job->printer, str, 256, omit_shellescapes);
-        arglist_remove(arglist, "-P");
-    }
-
-    /* Were we called from a PDQ wrapper? */
-    if (arglist_remove_flag(arglist, "--pdq"))
-        spooler = SPOOLER_PDQ;
 
-    /* Were we called to build the PDQ driver declaration file? */
-    genpdqfile = check_pdq_file(arglist);
-    if (genpdqfile)
-        spooler = SPOOLER_PDQ;
+            strncpy(job->user, str, 127);
+            job->user[127] = '\0';
+            arglist_remove(arglist, "-n");
+        }
+        if (arglist_remove(arglist, "-w") ||
+            arglist_remove(arglist, "-l") ||
+            arglist_remove(arglist, "-x") ||
+            arglist_remove(arglist, "-y") ||
+            arglist_remove(arglist, "-i") ||
+            arglist_remove_flag(arglist, "-c")) {
+                if (spooler != SPOOLER_GNULPR && spooler != SPOOLER_LPRNG)
+                    spooler = SPOOLER_LPD;
+        }
+        /* LPRng delivers the option settings via the "-Z" argument */
+        if ((str = arglist_get_value(arglist, "-Z"))) {
+            spooler = SPOOLER_LPRNG;
+            dstrcatf(job->optstr, "%s ", str);
+            arglist_remove(arglist, "-Z");
+        }
+        /* Job title and options for stock LPD */
+        if ((str = arglist_get_value(arglist, "-j")) || (str = arglist_get_value(arglist, "-J"))) {
+            strncpy_omit(job->title, str, 128, omit_shellescapes);
+            if (spooler == SPOOLER_LPD)
+                 dstrcatf(job->optstr, "%s ", job->title);
+             if (!arglist_remove(arglist, "-j"))
+                arglist_remove(arglist, "-J");
+        }
+
+        /* Check for CPS */
+        if (arglist_remove_flag(arglist, "--cps") > 0)
+            spooler = SPOOLER_CPS;
+
+        /* PPD file name given via the command line
+           allow duplicates, and use the last specified one */
+        if (spooler != SPOOLER_GNULPR && spooler != SPOOLER_LPRNG &&
+	    spooler != SPOOLER_LPD) {
+            while ((str = arglist_get_value(arglist, "-p"))) {
+                strncpy(job->ppdfile, str, 256);
+                arglist_remove(arglist, "-p");
+            }
+	    while ((str = arglist_get_value(arglist, "--ppd"))) {
+	        strncpy(job->ppdfile, str, 256);
+	        arglist_remove(arglist, "--ppd");
+	    }
+        }
+
+        /* Options for spooler-less printing, CPS, or PDQ */
+        while ((str = arglist_get_value(arglist, "-o"))) {
+            strncpy_omit(tmp, str, 1024, omit_shellescapes);
+            dstrcatf(job->optstr, "%s ", tmp);
+            arglist_remove(arglist, "-o");
+            /* If we don't print as PPR RIP or as CPS filter, we print
+               without spooler (we check for PDQ later) */
+            if (spooler != SPOOLER_PPR && spooler != SPOOLER_CPS)
+                spooler = SPOOLER_DIRECT;
+        }
+
+        /* Printer for spooler-less printing or PDQ */
+        if ((str = arglist_get_value(arglist, "-d"))) {
+            strncpy_omit(job->printer, str, 256, omit_shellescapes);
+            arglist_remove(arglist, "-d");
+        }
+
+        /* Printer for spooler-less printing, PDQ, or LPRng */
+        if ((str = arglist_get_value(arglist, "-P"))) {
+            strncpy_omit(job->printer, str, 256, omit_shellescapes);
+            arglist_remove(arglist, "-P");
+        }
+
+        /* Were we called from a PDQ wrapper? */
+        if (arglist_remove_flag(arglist, "--pdq"))
+            spooler = SPOOLER_PDQ;
+
+        /* Were we called to build the PDQ driver declaration file? */
+        genpdqfile = check_pdq_file(arglist);
+        if (genpdqfile)
+            spooler = SPOOLER_PDQ;
+    }
 
     /* spooler specific initialization */
     switch (spooler) {