From 0ff8897367c7341f2500770c3977038cdd7c0214 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <msweet@msweet.org>
Date: Tue, 31 Mar 2026 14:50:06 -0400
Subject: [PATCH] Expand allocation of options string.

---
 CHANGES.md      |  2 ++
 scheduler/job.c | 16 ++++------------
 2 files changed, 6 insertions(+), 12 deletions(-)

#diff --git a/CHANGES.md b/CHANGES.md
#index 2d45a370c..2e2973b70 100644
#--- a/CHANGES.md
#+++ b/CHANGES.md
#@@ -11,6 +11,8 @@ Changes in CUPS v2.4.17 (YYYY-MM-DD)
#   directory.
# - CVE-2026-NNNNN: The scheduler did not filter control characters from option
#   values.
#+- CVE-2026-NNNNN: The scheduler did not always allocate enough memory for a
#+  job's options string.
# - The scheduler followed symbolic links when cleaning out its temporary
#   directory (Issue #1448)
# - Updated `cupsFileGetConf` and `cupsFilePutConf` to escape more characters.
--- a/scheduler/job.c
+++ b/scheduler/job.c
@@ -4209,18 +4209,6 @@ ipp_length(ipp_t *ipp)			/* I - IPP requ
   for (attr = ipp->attrs; attr != NULL; attr = attr->next)
   {
    /*
-    * Skip attributes that won't be sent to filters...
-    */
-
-    if (attr->value_tag == IPP_TAG_NOVALUE ||
-	attr->value_tag == IPP_TAG_MIMETYPE ||
-	attr->value_tag == IPP_TAG_NAMELANG ||
-	attr->value_tag == IPP_TAG_TEXTLANG ||
-	attr->value_tag == IPP_TAG_URI ||
-	attr->value_tag == IPP_TAG_URISCHEME)
-      continue;
-
-   /*
     * Add space for a leading space and commas between each value.
     * For the first attribute, the leading space isn't used, so the
     * extra byte can be used as the nul terminator...
@@ -4295,10 +4283,14 @@ ipp_length(ipp_t *ipp)			/* I - IPP requ
 
       case IPP_TAG_TEXT :
       case IPP_TAG_NAME :
+      case IPP_TAG_TEXTLANG :
+      case IPP_TAG_NAMELANG :
+      case IPP_TAG_MIMETYPE :
       case IPP_TAG_KEYWORD :
       case IPP_TAG_CHARSET :
       case IPP_TAG_LANGUAGE :
       case IPP_TAG_URI :
+      case IPP_TAG_URISCHEME :
          /*
 	  * Strings can contain characters that need quoting.  We need
 	  * at least 2 * len + 2 characters to cover the quotes and
