Merge pull request #200 from OpenPrinting/ipptool

Merge changes for issue #196, fuzzipp improvements, and USB quirks (Issue #192) that mistakenly got added to ipptool branch...

CHANGES.md

@@ -31,8 +31,6 @@ CUPS v2.4rc1 (Pending)
 - The scheduler now includes the `[Job N]` prefix for job log messages, even
   when using syslog logging (Issue #154)
 - Added support for locales using the GB18030 character set (Issue #159)
-- The IPP parser now errors out when reading a member attribute outside a
-  collection.
 - `httpReconnect2` did not reset the socket file descriptor when the TLS
   negotiation failed (Apple #5907)
 - `httpUpdate` did not reset the socket file descriptor when the TLS
@@ -48,10 +46,13 @@ CUPS v2.4rc1 (Pending)
 - Fixed `job-pages-per-set` value for duplex print jobs.
 - Fixed an edge case in `ippReadIO` to make sure that only complete attributes
   and values are retained on an error (Issue #195)
+- Hardened `ippReadIO` to prevent invalid IPP messages from being propagated
+  (Issue #195, Issue #196)
 - Documentation fixes (Issue #92, Issue #163, Issue #177, Issue #184)
 - Localization updates (Issue #123, Issue #129, Issue #134, Issue #146,
   Issue #164)
-- USB quirk updates (Apple #5766, Apple #5838, Apple #5843, Apple #5867)
+- USB quirk updates (Issue #192, Apple #5766, Apple #5838, Apple #5843,
+  Apple #5867)
 - Web interface updates (Issue #142)
 - The `ippeveprinter` tool now automatically uses an available port.
 - Fixed some Windows issues.

backend/org.cups.usb-quirks

@@ -317,3 +317,6 @@
 
 # HP DesignJet 130 (Apple #5838)
 0x03f0 0x0314 no-reattach
+
+# Canon PIXMA MP480 (Issue #192)
+0x04a9 0x1731 unidir

cups/fuzzipp.c

@@ -29,7 +29,7 @@
  * Local types...
  */
 
-typedef struct _ippdata_t		// Data 
+typedef struct _ippdata_t		// Data
 {
   size_t	wused,			// Bytes used
 		wsize;			// Max size of buffer
@@ -79,9 +79,17 @@ main(int  argc,			// I - Number of command-line arguments
     ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "printer-uri", NULL, "ipp://localhost/printers/foo");
     ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_NAME, "requesting-user-name", NULL, "john-doe");
     ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_NAME, "job-name", NULL, "Test Job");
+    ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_MIMETYPE, "document-format", NULL, "application/pdf");
+    ippAddOctetString(request, IPP_TAG_OPERATION, "job-password", "8675309", 7);
+    ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_KEYWORD, "job-password-encryption", NULL, "none");
     ippAddString(request, IPP_TAG_JOB, IPP_TAG_KEYWORD, "print-color-mode", NULL, "color");
     ippAddInteger(request, IPP_TAG_JOB, IPP_TAG_ENUM, "print-quality", IPP_QUALITY_HIGH);
+    ippAddResolution(request, IPP_TAG_JOB, "printer-resolution", 1200, 1200, IPP_RES_PER_INCH);
     ippAddInteger(request, IPP_TAG_JOB, IPP_TAG_INTEGER, "copies", 42);
+    ippAddBoolean(request, IPP_TAG_JOB, "some-boolean-option", 1);
+    ippAddString(request, IPP_TAG_JOB, IPP_TAG_URISCHEME, "some-uri-scheme", NULL, "mailto");
+    ippAddString(request, IPP_TAG_JOB, IPP_TAG_NAMELANG, "some-name-with-language", "es-MX", "Jose");
+    ippAddString(request, IPP_TAG_JOB, IPP_TAG_TEXTLANG, "some-text-with-language", "es-MX", "¡Hola el mundo!");
     ippAddRange(request, IPP_TAG_JOB, "page-ranges", 1, 50);
     ippAddDate(request, IPP_TAG_JOB, "job-hold-until-time", ippTimeToDate(time(NULL) + 3600));
     ippAddString(request, IPP_TAG_JOB, IPP_TAG_TEXT, "job-message-to-operator", NULL, "This is a test job.");
@@ -127,7 +135,7 @@ main(int  argc,			// I - Number of command-line arguments
         perror(filename);
         return (1);
       }
- 
+
       cupsFileWrite(fp, (char *)buffer, data.wused);
       cupsFileClose(fp);
 
@@ -224,8 +232,8 @@ fuzzdata(_ippdata_t *data)		// I - Data buffer
   // Mutate a few times...
   for (i = 0; i < 32; i ++)
   {
-    // Each cycle remove or move bytes
-    switch (CUPS_RAND() & 7)
+    // Each cycle replace or swap bytes
+    switch ((len = CUPS_RAND() & 7))
     {
       case 0 :
       case 1 :
@@ -234,12 +242,18 @@ fuzzdata(_ippdata_t *data)		// I - Data buffer
       case 4 :
       case 5 :
       case 6 :
-          // Replace a byte
-          data->wbuffer[CUPS_RAND() % data->wused] = CUPS_RAND();
+          // Replace bytes
+          len ++;
+          pos = CUPS_RAND() % (data->wused - len);
+          while (len > 0)
+          {
+            data->wbuffer[pos ++] = CUPS_RAND();
+            len --;
+          }
           break;
 
       case 7 :
-          // Move bytes
+          // Swap bytes
           len  = (CUPS_RAND() & 7) + 1;
           pos  = CUPS_RAND() % (data->wused - len);
           pos2 = CUPS_RAND() % (data->wused - len);