1e7802c
diff -up cups-1.5.4/scheduler/printers.c.stringpool-setprinterattr cups-1.5.4/scheduler/printers.c
1e7802c
--- cups-1.5.4/scheduler/printers.c.stringpool-setprinterattr	2013-06-13 10:40:43.607590350 +0100
1e7802c
+++ cups-1.5.4/scheduler/printers.c	2013-06-13 10:53:31.134919727 +0100
1e7802c
@@ -2053,6 +2053,7 @@ cupsdSetPrinterAttr(
1e7802c
   ipp_attribute_t	*attr;		/* Attribute */
1e7802c
   int			i,		/* Looping var */
1e7802c
 			count;		/* Number of values */
1e7802c
+  char			*value_dup;	/* Copy of attribute value string */
1e7802c
   char			*ptr,		/* Pointer into value */
1e7802c
 			*start,		/* Start of value */
1e7802c
 			quote;		/* Quote character */
1e7802c
@@ -2121,16 +2122,24 @@ cupsdSetPrinterAttr(
1e7802c
       return;
1e7802c
     }
1e7802c
 
1e7802c
-    for (i = 0; i < count; i ++)
1e7802c
+    if ((value_dup = strdup(value)) == NULL)
1e7802c
     {
1e7802c
-      if ((ptr = strchr(value, ',')) != NULL)
1e7802c
+      cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to copy attribute value.");
1e7802c
+      return;
1e7802c
+    }
1e7802c
+
1e7802c
+    for (i = 0, start = value_dup; i < count; i ++)
1e7802c
+    {
1e7802c
+      if ((ptr = strchr(start, ',')) != NULL)
1e7802c
         *ptr++ = '\0';
1e7802c
 
1e7802c
-      attr->values[i].integer = strtol(value, NULL, 10);
1e7802c
+      attr->values[i].integer = strtol(start, NULL, 10);
1e7802c
 
1e7802c
       if (ptr)
1e7802c
-        value = ptr;
1e7802c
+        start = ptr;
1e7802c
     }
1e7802c
+
1e7802c
+    free(value_dup);
1e7802c
   }
1e7802c
   else
1e7802c
   {
1e7802c
@@ -2171,7 +2180,13 @@ cupsdSetPrinterAttr(
1e7802c
       return;
1e7802c
     }
1e7802c
 
1e7802c
-    for (i = 0, quote = '\0', ptr = value; i < count; i ++)
1e7802c
+    if ((value_dup = strdup(value)) == NULL)
1e7802c
+    {
1e7802c
+      cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to copy attribute value.");
1e7802c
+      return;
1e7802c
+    }
1e7802c
+
1e7802c
+    for (i = 0, quote = '\0', ptr = value_dup; i < count; i ++)
1e7802c
     {
1e7802c
       for (start = ptr; *ptr; ptr ++)
1e7802c
       {
1e7802c
@@ -2199,6 +2214,8 @@ cupsdSetPrinterAttr(
1e7802c
 
1e7802c
       attr->values[i].string.text = _cupsStrAlloc(start);
1e7802c
     }
1e7802c
+
1e7802c
+    free(value_dup);
1e7802c
   }
1e7802c
 }
1e7802c