From e58cba9d6fceed4242980e51dbd1302cf638ab1d Mon Sep 17 00:00:00 2001
From: Zdenek Dohnal <zdohnal@redhat.com>
Date: Thu, 11 Sep 2025 14:53:49 +0200
Subject: [PATCH] libcups: Fix handling of extension tag in `ipp_read_io()`

Fixes: CVE-2025-58364

Upstream-Status: Backport [https://github.com/OpenPrinting/cups/commit/e58cba9d6fceed4242980e51dbd1302cf638ab1d]
CVE: CVE-2025-58364
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
 cups/ipp.c | 26 +-------------------------
 1 file changed, 1 insertion(+), 25 deletions(-)

diff --git a/cups/ipp.c b/cups/ipp.c
index 47ba9fa..9b7bf3f 100644
--- a/cups/ipp.c
+++ b/cups/ipp.c
@@ -2949,31 +2949,6 @@ ippReadIO(void       *src,		/* I - Data source */
 	  */
 
           tag = (ipp_tag_t)buffer[0];
-          if (tag == IPP_TAG_EXTENSION)
-          {
-           /*
-            * Read 32-bit "extension" tag...
-            */
-
-	    if ((*cb)(src, buffer, 4) < 4)
-	    {
-	      DEBUG_puts("1ippReadIO: Callback returned EOF/error");
-	      goto rollback;
-	    }
-
-	    tag = (ipp_tag_t)((buffer[0] << 24) | (buffer[1] << 16) | (buffer[2] << 8) | buffer[3]);
-
-            if (tag & IPP_TAG_CUPS_CONST)
-            {
-             /*
-              * Fail if the high bit is set in the tag...
-              */
-
-	      _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("IPP extension tag larger than 0x7FFFFFFF."), 1);
-	      DEBUG_printf(("1ippReadIO: bad tag 0x%x.", tag));
-	      goto rollback;
-            }
-          }
 
 	  if (tag == IPP_TAG_END)
 	  {
@@ -3196,6 +3171,7 @@ ippReadIO(void       *src,		/* I - Data source */
 
 	    if ((*cb)(src, buffer, (size_t)n) < n)
 	    {
+		 _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to read IPP attribute name."), 1);
 	      DEBUG_puts("1ippReadIO: unable to read name.");
 	      goto rollback;
 	    }
-- 
2.25.1

