Backport of:

From 928a86b1b794f738f0a3dc87561b2e054bff7ce4 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <msweet@msweet.org>
Date: Sun, 5 Apr 2026 10:45:25 -0400
Subject: [PATCH] Range check job-password-supported.

---
 CHANGES.md       | 1 +
 cups/ppd-cache.c | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

#diff --git a/CHANGES.md b/CHANGES.md
#index 564d743e04..c2ac8cc868 100644
#--- a/CHANGES.md
#+++ b/CHANGES.md
#@@ -33,6 +33,7 @@ Changes in CUPS v2.4.17 (YYYY-MM-DD)
# - Fixed the mapping of supply type keywords to SNMP names.
# - Fixed a bug in the IPP backend when SNMP was disabled.
# - Fixed a crash bug in the rastertoepson filter.
#+- Fixed the range check for job password strings.
# 
# 
# Changes in CUPS v2.4.16 (2025-12-04)
--- a/cups/ppd-cache.c
+++ b/cups/ppd-cache.c
@@ -4470,7 +4470,7 @@ _ppdCreateFromIPP2(
   * Password/PIN printing...
   */
 
-  if ((attr = ippFindAttribute(supported, "job-password-supported", IPP_TAG_INTEGER)) != NULL)
+  if ((attr = ippFindAttribute(supported, "job-password-supported", IPP_TAG_INTEGER)) != NULL && ippGetInteger(attr, 0) > 0)
   {
     char	pattern[33];		/* Password pattern */
     int		maxlen = ippGetInteger(attr, 0);
