From 8a70a7b138dd2932a599125910eb4e7923232129 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <msweet@msweet.org>
Date: Tue, 14 Apr 2026 13:04:58 -0400
Subject: [PATCH] Add buffer size check from CUPS 2.5.x to _ippFileReadToken
 (Issue #1542)

---
 CHANGES.md      | 1 +
 cups/ipp-file.c | 3 +++
 2 files changed, 4 insertions(+)

#diff --git a/CHANGES.md b/CHANGES.md
#index 3f7917b1e3..3a0082ba2e 100644
#--- a/CHANGES.md
#+++ b/CHANGES.md
#@@ -41,6 +41,7 @@ Changes in CUPS v2.4.17 (YYYY-MM-DD)
# - Fixed a recursion issue with encoding of nested collections (Issue #1539)
# - Fixed parsing of the `LimitRequestBody`, `MaxLogSize`, and `MaxRequestSize`
#   directives in "cupsd.conf" (Issue #1540)
#+- Fixed a parsing bug in `ipptool` (Issue #1542)
# - Fixed blank line detection in the `rastertolabel` filter (Issue #1545)
# 
# 
--- a/cups/ipp-file.c
+++ b/cups/ipp-file.c
@@ -213,6 +213,9 @@ _ippFileReadToken(_ipp_file_t *f,	/* I -
 	*tokend = token + tokensize - 1;/* End of token buffer */
 
 
+  if (tokensize < 32)
+    return (0);
+
  /*
   * Skip whitespace and comments...
   */
