Backport of:

From b7c2525a885f528d243c3a92197ca99609b3f080 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <msweet@msweet.org>
Date: Mon, 13 Apr 2026 11:50:23 -0400
Subject: [PATCH] Limit num_bytes for SNMP string values.

---
 cups/snmp-private.h | 6 +++---
 cups/snmp.c         | 8 ++++++--
 2 files changed, 9 insertions(+), 5 deletions(-)

--- a/cups/snmp-private.h
+++ b/cups/snmp-private.h
@@ -57,9 +57,9 @@ typedef enum cups_asn1_e cups_asn1_t;	/*
 
 typedef struct cups_snmp_string_s	/**** String value ****/
 {
-  unsigned char	bytes[CUPS_SNMP_MAX_STRING];
-					/* Bytes in string */
   unsigned	num_bytes;		/* Number of bytes */
+  unsigned char	bytes[CUPS_SNMP_MAX_STRING + 1];
+					/* Bytes in string */
 } cups_snmp_string_t;
 
 union cups_snmp_value_u			/**** Object value ****/
--- a/cups/snmp.c
+++ b/cups/snmp.c
@@ -1036,10 +1036,14 @@ asn1_decode_snmp(unsigned char *buffer,
 	        case CUPS_ASN1_OCTET_STRING :
 	        case CUPS_ASN1_BIT_STRING :
 	        case CUPS_ASN1_HEX_STRING :
-		    packet->object_value.string.num_bytes = length;
 		    asn1_get_string(&bufptr, bufend, length,
 		                    (char *)packet->object_value.string.bytes,
 				    sizeof(packet->object_value.string.bytes));
+
+                    if (length >= sizeof(packet->object_value.string.bytes))
+		      packet->object_value.string.num_bytes = sizeof(packet->object_value.string.bytes) - 1;
+                    else
+		      packet->object_value.string.num_bytes = length;
 	            break;
 
 	        case CUPS_ASN1_OID :
