Blob Blame History Raw
diff -up cups-1.3.5/cgi-bin/template.c.1.3.x cups-1.3.5/cgi-bin/template.c
--- cups-1.3.5/cgi-bin/template.c.1.3.x	2007-08-15 20:33:36.000000000 +0100
+++ cups-1.3.5/cgi-bin/template.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   CGI template function.
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2006 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -54,6 +54,13 @@ cgiCopyTemplateFile(FILE       *out,	/* 
           tmpl ? tmpl : "(null)");
 
  /*
+  * Range check input...
+  */
+
+  if (!tmpl || !out)
+    return;
+
+ /*
   * Open the template file...
   */
 
diff -up cups-1.3.5/cgi-bin/admin.c.1.3.x cups-1.3.5/cgi-bin/admin.c
--- cups-1.3.5/cgi-bin/admin.c.1.3.x	2007-11-30 07:00:59.000000000 +0000
+++ cups-1.3.5/cgi-bin/admin.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Administration CGI for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -1333,12 +1333,12 @@ do_config_server(http_t *http)		/* I - H
 			*remote_printers,
 					/* REMOTE_PRINTERS value */
 			*share_printers,/* SHARE_PRINTERS value */
+			*user_cancel_any;
+					/* USER_CANCEL_ANY value */
 #ifdef HAVE_GSSAPI
-			*default_auth_type,
+    char		default_auth_type[255];
 					/* DefaultAuthType value */
 #endif /* HAVE_GSSAPI */
-			*user_cancel_any;
-					/* USER_CANCEL_ANY value */
 
 
    /*
@@ -1373,13 +1373,16 @@ do_config_server(http_t *http)		/* I - H
     */
 
     if (cgiGetVariable("KERBEROS"))
-      default_auth_type = "Negotiate";
+      strlcpy(default_auth_type, "Negotiate", sizeof(default_auth_type));
     else
     {
-      default_auth_type = cupsGetOption("DefaultAuthType", num_settings,
-                                        settings);
-      if (!strcasecmp(default_auth_type, "Negotiate"))
-        default_auth_type = "Basic";
+      const char *val = cupsGetOption("DefaultAuthType", num_settings,
+                                      settings);
+
+      if (val && !strcasecmp(val, "Negotiate"))
+        strlcpy(default_auth_type, "Basic", sizeof(default_auth_type));
+      else
+        strlcpy(default_auth_type, val, sizeof(default_auth_type));
     }
 
     fprintf(stderr, "DEBUG: DefaultAuthType %s\n", default_auth_type);
@@ -1647,14 +1650,15 @@ do_config_server(http_t *http)		/* I - H
     * Allocate memory and load the file into a string buffer...
     */
 
-    buffer = calloc(1, info.st_size + 1);
+    if ((buffer = calloc(1, info.st_size + 1)) != NULL)
+    {
+      cupsFileRead(cupsd, buffer, info.st_size);
+      cgiSetVariable("CUPSDCONF", buffer);
+      free(buffer);
+    }
 
-    cupsFileRead(cupsd, buffer, info.st_size);
     cupsFileClose(cupsd);
 
-    cgiSetVariable("CUPSDCONF", buffer);
-    free(buffer);
-
    /*
     * Then get the default cupsd.conf file and put that into a string as
     * well...
@@ -1665,37 +1669,39 @@ do_config_server(http_t *http)		/* I - H
     if (!stat(filename, &info) && info.st_size < (1024 * 1024) &&
         (cupsd = cupsFileOpen(filename, "r")) != NULL)
     {
-      buffer = calloc(1, 2 * info.st_size + 1);
-      bufend = buffer + 2 * info.st_size - 1;
-
-      for (bufptr = buffer;
-           bufptr < bufend && (ch = cupsFileGetChar(cupsd)) != EOF;)
+      if ((buffer = calloc(1, 2 * info.st_size + 1)) != NULL)
       {
-        if (ch == '\\' || ch == '\"')
-	{
-	  *bufptr++ = '\\';
-	  *bufptr++ = ch;
-	}
-	else if (ch == '\n')
-	{
-	  *bufptr++ = '\\';
-	  *bufptr++ = 'n';
-	}
-	else if (ch == '\t')
+	bufend = buffer + 2 * info.st_size - 1;
+
+	for (bufptr = buffer;
+	     bufptr < bufend && (ch = cupsFileGetChar(cupsd)) != EOF;)
 	{
-	  *bufptr++ = '\\';
-	  *bufptr++ = 't';
+	  if (ch == '\\' || ch == '\"')
+	  {
+	    *bufptr++ = '\\';
+	    *bufptr++ = ch;
+	  }
+	  else if (ch == '\n')
+	  {
+	    *bufptr++ = '\\';
+	    *bufptr++ = 'n';
+	  }
+	  else if (ch == '\t')
+	  {
+	    *bufptr++ = '\\';
+	    *bufptr++ = 't';
+	  }
+	  else if (ch >= ' ')
+	    *bufptr++ = ch;
 	}
-	else if (ch >= ' ')
-	  *bufptr++ = ch;
-      }
 
-      *bufptr = '\0';
+	*bufptr = '\0';
 
-      cupsFileClose(cupsd);
+	cgiSetVariable("CUPSDCONF_DEFAULT", buffer);
+	free(buffer);
+      }
 
-      cgiSetVariable("CUPSDCONF_DEFAULT", buffer);
-      free(buffer);
+      cupsFileClose(cupsd);
     }
 
    /*
@@ -3084,7 +3090,7 @@ do_set_options(http_t *http,		/* I - HTT
     * Binary protocol support...
     */
 
-    if (ppd->protocols && strstr(ppd->protocols, "BCP"))
+    if (ppd && ppd->protocols && strstr(ppd->protocols, "BCP"))
     {
       protocol = ppdFindAttr(ppd, "cupsProtocol", NULL);
 
diff -up cups-1.3.5/cgi-bin/search.c.1.3.x cups-1.3.5/cgi-bin/search.c
--- cups-1.3.5/cgi-bin/search.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/cgi-bin/search.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Search routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2006 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -53,7 +53,8 @@ cgiCompileSearch(const char *query)	/* I
   * Allocate a regular expression storage structure...
   */
 
-  re = (regex_t *)calloc(1, sizeof(regex_t));
+  if ((re = (regex_t *)calloc(1, sizeof(regex_t))) == NULL)
+    return (NULL);
 
  /*
   * Allocate a buffer to hold the regular expression string, starting
@@ -65,7 +66,11 @@ cgiCompileSearch(const char *query)	/* I
   if (slen < 1024)
     slen = 1024;
 
-  s = (char *)malloc(slen);
+  if ((s = (char *)malloc(slen)) == NULL)
+  {
+    free(re);
+    return (NULL);
+  }
 
  /*
   * Copy the query string to the regular expression, handling basic
@@ -227,7 +232,13 @@ cgiCompileSearch(const char *query)	/* I
         char *lword2;			/* New "last word" */
 
 
-        lword2 = strdup(sword);
+        if ((lword2 = strdup(sword)) == NULL)
+	{
+	  free(lword);
+	  free(s);
+	  free(re);
+	  return (NULL);
+	}
 
         strcpy(sptr, ".*|.*");
 	sptr += 5;
diff -up cups-1.3.5/cgi-bin/ipp-var.c.1.3.x cups-1.3.5/cgi-bin/ipp-var.c
--- cups-1.3.5/cgi-bin/ipp-var.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/cgi-bin/ipp-var.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   CGI <-> IPP variable routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -158,6 +158,8 @@ cgiGetAttributes(ipp_t      *request,	/*
     for (i = 0; i < num_attrs; i ++)
       free(attrs[i]);
   }
+
+  fclose(in);
 }
 
 
@@ -523,8 +525,7 @@ cgiPrintTestPage(http_t     *http,	/* I 
   * See who is logged in...
   */
 
-  if ((user = getenv("REMOTE_USER")) == NULL)
-    user = "guest";
+  user = getenv("REMOTE_USER");
 
  /*
   * Locate the test page file...
@@ -562,8 +563,9 @@ cgiPrintTestPage(http_t     *http,	/* I 
   ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "printer-uri",
                NULL, uri);
 
-  ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_NAME,
-               "requesting-user-name", NULL, user);
+  if (user)
+    ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_NAME,
+		 "requesting-user-name", NULL, user);
 
   ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_NAME, "job-name",
                NULL, "Test Page");
@@ -593,6 +595,11 @@ cgiPrintTestPage(http_t     *http,	/* I 
     snprintf(refresh, sizeof(refresh), "2;URL=%s", uri);
     cgiSetVariable("refresh_page", refresh);
   }
+  else if (cupsLastError() == IPP_NOT_AUTHORIZED)
+  {
+    puts("Status: 401\n");
+    exit(0);
+  }
 
   cgiStartHTML(cgiText(_("Print Test Page")));
 
diff -up cups-1.3.5/cgi-bin/jobs.c.1.3.x cups-1.3.5/cgi-bin/jobs.c
--- cups-1.3.5/cgi-bin/jobs.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/cgi-bin/jobs.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Job status CGI for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2006 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -185,6 +185,11 @@ do_job_op(http_t      *http,		/* I - HTT
     cgiFormEncode(url + 6, getenv("HTTP_REFERER"), sizeof(url) - 6);
     cgiSetVariable("refresh_page", url);
   }
+  else if (cupsLastError() == IPP_NOT_AUTHORIZED)
+  {
+    puts("Status: 401\n");
+    exit(0);
+  }
 
   cgiStartHTML(cgiText(_("Jobs")));
 
diff -up cups-1.3.5/cgi-bin/var.c.1.3.x cups-1.3.5/cgi-bin/var.c
--- cups-1.3.5/cgi-bin/var.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/cgi-bin/var.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   CGI form variable and array functions.
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2005 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -322,9 +322,15 @@ cgiSetArray(const char *name,		/* I - Na
   {
     if (element >= var->avalues)
     {
+      const char **temp;		/* Temporary pointer */
+
+      temp = (const char **)realloc((void *)(var->values),
+                                    sizeof(char *) * (element + 16));
+      if (!temp)
+        return;
+
       var->avalues = element + 16;
-      var->values  = (const char **)realloc((void *)(var->values),
-                                            sizeof(char *) * var->avalues);
+      var->values  = temp;
     }
 
     if (element >= var->nvalues)
@@ -362,9 +368,15 @@ cgiSetSize(const char *name,		/* I - Nam
 
   if (size >= var->avalues)
   {
+    const char **temp;			/* Temporary pointer */
+
+    temp = (const char **)realloc((void *)(var->values),
+				  sizeof(char *) * (size + 16));
+    if (!temp)
+      return;
+
     var->avalues = size + 16;
-    var->values  = (const char **)realloc((void *)(var->values),
-                                          sizeof(char *) * var->avalues);
+    var->values  = temp;
   }
 
   if (size > var->nvalues)
@@ -426,7 +438,7 @@ cgi_add_variable(const char *name,	/* I 
 		 int        element,	/* I - Array element number */
                  const char *value)	/* I - Variable value */
 {
-  _cgi_var_t	*var;				/* New variable */
+  _cgi_var_t	*var;			/* New variable */
 
 
   if (name == NULL || value == NULL || element < 0 || element > 100000)
@@ -438,19 +450,29 @@ cgi_add_variable(const char *name,	/* I 
 
   if (form_count >= form_alloc)
   {
+    _cgi_var_t	*temp_vars;		/* Temporary form pointer */
+
+
     if (form_alloc == 0)
-      form_vars = malloc(sizeof(_cgi_var_t) * 16);
+      temp_vars = malloc(sizeof(_cgi_var_t) * 16);
     else
-      form_vars = realloc(form_vars, (form_alloc + 16) * sizeof(_cgi_var_t));
+      temp_vars = realloc(form_vars, (form_alloc + 16) * sizeof(_cgi_var_t));
+
+    if (!temp_vars)
+      return;
 
+    form_vars  = temp_vars;
     form_alloc += 16;
   }
 
-  var                  = form_vars + form_count;
+  var = form_vars + form_count;
+
+  if ((var->values = calloc(element + 1, sizeof(char *))) == NULL)
+    return;
+
   var->name            = strdup(name);
   var->nvalues         = element + 1;
   var->avalues         = element + 1;
-  var->values          = calloc(element + 1, sizeof(char *));
   var->values[element] = strdup(value);
 
   form_count ++;
@@ -784,11 +806,15 @@ cgi_initialize_post(void)
 
   for (tbytes = 0; tbytes < length; tbytes += nbytes)
     if ((nbytes = read(0, data + tbytes, length - tbytes)) < 0)
+    {
       if (errno != EAGAIN)
       {
         free(data);
         return (0);
       }
+      else
+        nbytes = 0;
+    }
 
   data[length] = '\0';
 
diff -up cups-1.3.5/cgi-bin/printers.c.1.3.x cups-1.3.5/cgi-bin/printers.c
--- cups-1.3.5/cgi-bin/printers.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/cgi-bin/printers.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Printer status CGI for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2006 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -280,6 +280,11 @@ print_command(http_t     *http,		/* I - 
     snprintf(refresh, sizeof(refresh), "2;URL=%s", uri);
     cgiSetVariable("refresh_page", refresh);
   }
+  else if (cupsLastError() == IPP_NOT_AUTHORIZED)
+  {
+    puts("Status: 401\n");
+    exit(0);
+  }
 
   cgiStartHTML(cgiText(_("Printer Maintenance")));
 
diff -up cups-1.3.5/locale/checkpo.c.1.3.x cups-1.3.5/locale/checkpo.c
--- cups-1.3.5/locale/checkpo.c.1.3.x	2007-09-06 15:34:31.000000000 +0100
+++ cups-1.3.5/locale/checkpo.c	2008-02-14 13:03:30.000000000 +0000
@@ -50,8 +50,7 @@ main(int  argc,				/* I - Number of comm
 			*strfmts;	/* Format strings in msgstr */
   char			*idfmt,		/* Current msgid format string */
 			*strfmt;	/* Current msgstr format string */
-  int			fmtidx,		/* Format index */
-			fmtcount;	/* Format count */
+  int			fmtidx;		/* Format index */
   int			status,		/* Exit status */
 			pass,		/* Pass/fail status */
 			untranslated;	/* Untranslated messages */
@@ -135,8 +134,6 @@ main(int  argc,				/* I - Number of comm
 
 	  if (!idfmt || strcmp(strfmt, idfmt))
 	    break;
-
-	  fmtcount ++;
 	}
 
         if (cupsArrayCount(strfmts) != cupsArrayCount(idfmts) || strfmt)
diff -up cups-1.3.5/backend/usb-unix.c.1.3.x cups-1.3.5/backend/usb-unix.c
--- cups-1.3.5/backend/usb-unix.c.1.3.x	2007-11-30 07:00:59.000000000 +0000
+++ cups-1.3.5/backend/usb-unix.c	2008-02-14 13:03:30.000000000 +0000
@@ -516,7 +516,7 @@ open_device(const char *uri,		/* I - Dev
   }
 #else
   {
-    if (use_bc)
+    if (*use_bc)
       fd = open(uri + 4, O_RDWR | O_EXCL);
     else
       fd = -1;
diff -up cups-1.3.5/backend/snmp.c.1.3.x cups-1.3.5/backend/snmp.c
--- cups-1.3.5/backend/snmp.c.1.3.x	2007-12-17 22:12:45.000000000 +0000
+++ cups-1.3.5/backend/snmp.c	2008-02-14 13:03:30.000000000 +0000
@@ -1090,7 +1090,7 @@ asn1_get_string(
     * String is larger than the buffer...
     */
 
-    memcpy(string, buffer, strsize - 1);
+    memcpy(string, *buffer, strsize - 1);
     string[strsize - 1] = '\0';
   }
 
diff -up cups-1.3.5/backend/pap.c.1.3.x cups-1.3.5/backend/pap.c
--- cups-1.3.5/backend/pap.c.1.3.x	2007-10-10 22:25:29.000000000 +0100
+++ cups-1.3.5/backend/pap.c	2008-02-14 13:03:30.000000000 +0000
@@ -1,7 +1,7 @@
 /*
 * "$Id: pap.c 7013 2007-10-10 21:25:29Z mike $"
 *
-* © Copyright 2004 Apple Computer, Inc. All rights reserved.
+* © Copyright 2004-2008 Apple Computer, Inc. All rights reserved.
 * 
 * IMPORTANT:  This Apple software is supplied to you by Apple Computer,
 * Inc. ("Apple") in consideration of your agreement to the following
@@ -70,6 +70,16 @@
 *  signalHandler()	 - handle SIGINT to close the session before quiting.
 */
 
+/*
+ * This backend uses deprecated APIs for AppleTalk; we know this, so
+ * silence any warnings about it...
+ */
+
+#ifdef MAC_OS_X_VERSION_MIN_REQUIRED
+#  undef MAC_OS_X_VERSION_MIN_REQUIRED
+#endif /* MAX_OS_X_VERSION_MIN_REQUIRED */
+#define MAC_OS_X_VERSION_MIN_REQUIRED MAC_OS_X_VERSION_10_0
+
 #include <config.h>
 
 #include <stdio.h>
@@ -85,17 +95,17 @@
 #include <sys/time.h>
 #include <sys/errno.h>
 
+#include <cups/cups.h>
+#include <cups/backend.h>
+#include <cups/sidechannel.h>
+#include <cups/i18n.h>
+
 #include <netat/appletalk.h>
 #include <netat/atp.h>
 #include <netat/ddp.h>
 #include <netat/nbp.h>
 #include <netat/pap.h>
 
-#include <cups/cups.h>
-#include <cups/backend.h>
-#include <cups/sidechannel.h>
-#include <cups/i18n.h>
-
 #include <libkern/OSByteOrder.h>
 
 #ifdef HAVE_APPLETALK_AT_PROTO_H
diff -up cups-1.3.5/backend/runloop.c.1.3.x cups-1.3.5/backend/runloop.c
--- cups-1.3.5/backend/runloop.c.1.3.x	2007-08-22 19:34:34.000000000 +0100
+++ cups-1.3.5/backend/runloop.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Common run loop APIs for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 2006-2007 by Easy Software Products, all rights reserved.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -216,7 +216,7 @@ backendRunLoop(
       FD_SET(CUPS_SC_FD, &input);
 
     FD_ZERO(&output);
-    if (print_bytes || !use_bc)
+    if (print_bytes || (!use_bc && !side_cb))
       FD_SET(device_fd, &output);
 
     if (use_bc || side_cb)
diff -up cups-1.3.5/backend/ipp.c.1.3.x cups-1.3.5/backend/ipp.c
--- cups-1.3.5/backend/ipp.c.1.3.x	2007-11-09 19:54:09.000000000 +0000
+++ cups-1.3.5/backend/ipp.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   IPP backend for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -521,8 +521,8 @@ main(int  argc,				/* I - Number of comm
 	              _("INFO: Unable to contact printer, queuing on next "
 			"printer in class...\n"));
 
-        if (argc == 6 || strcmp(filename, argv[6]))
-	  unlink(filename);
+        if (tmpfilename[0])
+	  unlink(tmpfilename);
 
        /*
         * Sleep 5 seconds to keep the job from requeuing too rapidly...
@@ -579,8 +579,8 @@ main(int  argc,				/* I - Number of comm
 
   if (job_cancelled)
   {
-    if (argc == 6 || strcmp(filename, argv[6]))
-      unlink(filename);
+    if (tmpfilename[0])
+      unlink(tmpfilename);
 
     return (CUPS_BACKEND_FAILED);
   }
@@ -765,8 +765,8 @@ main(int  argc,				/* I - Number of comm
       ippDelete(supported);
       httpClose(http);
 
-      if (argc == 6 || strcmp(filename, argv[6]))
-	unlink(filename);
+      if (tmpfilename[0])
+	unlink(tmpfilename);
 
      /*
       * Sleep 5 seconds to keep the job from requeuing too rapidly...
@@ -865,12 +865,13 @@ main(int  argc,				/* I - Number of comm
     num_options = cupsParseOptions(argv[5], 0, &options);
 
 #ifdef __APPLE__
-    if (!strcasecmp(content_type, "application/pictwps") && num_files == 1)
+    if (!strcasecmp(final_content_type, "application/pictwps") &&
+        num_files == 1)
     {
       if (format_sup != NULL)
       {
 	for (i = 0; i < format_sup->num_values; i ++)
-	  if (!strcasecmp(content_type, format_sup->values[i].string.text))
+	  if (!strcasecmp(final_content_type, format_sup->values[i].string.text))
 	    break;
       }
 
@@ -881,10 +882,18 @@ main(int  argc,				/* I - Number of comm
 	* so convert the document to PostScript...
 	*/
 
-	if (run_pictwps_filter(argv, filename))
+	if (run_pictwps_filter(argv, files[0]))
+	{
+	  if (pstmpname[0])
+	    unlink(pstmpname);
+
+	  if (tmpfilename[0])
+	    unlink(tmpfilename);
+
 	  return (CUPS_BACKEND_FAILED);
+        }
 
-        filename = pstmpname;
+        files[0] = pstmpname;
 
        /*
 	* Change the MIME type to application/postscript and change the
@@ -1680,7 +1689,6 @@ run_pictwps_filter(char       **argv,	/*
 
     _cupsLangPrintf(stderr, _("ERROR: Unable to fork pictwpstops: %s\n"),
 		    strerror(errno));
-    unlink(filename);
     if (ppdfile)
       unlink(ppdfile);
     return (-1);
@@ -1695,7 +1703,6 @@ run_pictwps_filter(char       **argv,	/*
     _cupsLangPrintf(stderr, _("ERROR: Unable to wait for pictwpstops: %s\n"),
 		    strerror(errno));
     close(fd);
-    unlink(filename);
     if (ppdfile)
       unlink(ppdfile);
     return (-1);
@@ -1715,7 +1722,6 @@ run_pictwps_filter(char       **argv,	/*
       _cupsLangPrintf(stderr, _("ERROR: pictwpstops exited on signal %d!\n"),
 		      status);
 
-    unlink(filename);
     return (status);
   }
 
diff -up cups-1.3.5/cups/adminutil.c.1.3.x cups-1.3.5/cups/adminutil.c
--- cups-1.3.5/cups/adminutil.c.1.3.x	2007-11-30 07:00:59.000000000 +0000
+++ cups-1.3.5/cups/adminutil.c	2008-02-14 13:03:30.000000000 +0000
@@ -4,7 +4,7 @@
  *   Administration utility API definitions for the Common UNIX Printing
  *   System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 2001-2007 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -1057,7 +1057,7 @@ _cupsAdminGetServerSettings(
 	in_admin_location = 0;
 	in_location       = 0;
       }
-      else if (!strcasecmp(line, "Allow") && in_admin_location &&
+      else if (!strcasecmp(line, "Allow") &&
                strcasecmp(value, "localhost") && strcasecmp(value, "127.0.0.1")
 #ifdef AF_LOCAL
 	       && *value != '/'
@@ -1067,9 +1067,9 @@ _cupsAdminGetServerSettings(
 #endif /* AF_INET6 */
 	       )
       {
-	remote_admin = 1;
-
-	if (!strcasecmp(value, "all"))
+        if (in_admin_location)
+	  remote_admin = 1;
+        else if (!strcasecmp(value, "all"))
 	  remote_any = 1;
       }
       else if (line[0] != '<' && !in_location && !in_policy)
@@ -1578,8 +1578,6 @@ _cupsAdminSetServerSettings(
 	if (remote_admin)
 	  cupsFilePrintf(temp, "  Allow %s\n",
 	                 remote_any > 0 ? "all" : "@LOCAL");
-	else
-	  cupsFilePuts(temp, "  Allow localhost\n");
       }
       else if (in_conf_location && remote_admin >= 0)
       {
@@ -1597,8 +1595,6 @@ _cupsAdminSetServerSettings(
 	if (remote_admin)
 	  cupsFilePrintf(temp, "  Allow %s\n",
 	                 remote_any > 0 ? "all" : "@LOCAL");
-	else
-	  cupsFilePuts(temp, "  Allow localhost\n");
       }
       else if (in_root_location && (remote_admin >= 0 || share_printers >= 0))
       {
@@ -1619,8 +1615,6 @@ _cupsAdminSetServerSettings(
 	if (remote_admin > 0 || share_printers > 0)
 	  cupsFilePrintf(temp, "  Allow %s\n",
 	                 remote_any > 0 ? "all" : "@LOCAL");
-	else
-	  cupsFilePuts(temp, "  Allow localhost\n");
       }
 
       in_admin_location = 0;
@@ -1841,8 +1835,6 @@ _cupsAdminSetServerSettings(
 
     if (remote_admin > 0 || share_printers > 0)
       cupsFilePrintf(temp, "  Allow %s\n", remote_any > 0 ? "all" : "@LOCAL");
-    else
-      cupsFilePuts(temp, "  Allow localhost\n");
 
     cupsFilePuts(temp, "</Location>\n");
   }
@@ -1859,8 +1851,6 @@ _cupsAdminSetServerSettings(
 
     if (remote_admin)
       cupsFilePrintf(temp, "  Allow %s\n", remote_any > 0 ? "all" : "@LOCAL");
-    else
-      cupsFilePuts(temp, "  Allow localhost\n");
 
     cupsFilePuts(temp, "</Location>\n");
   }
@@ -1880,8 +1870,6 @@ _cupsAdminSetServerSettings(
 
     if (remote_admin)
       cupsFilePrintf(temp, "  Allow %s\n", remote_any > 0 ? "all" : "@LOCAL");
-    else
-      cupsFilePuts(temp, "  Allow localhost\n");
 
     cupsFilePuts(temp, "</Location>\n");
   }
diff -up cups-1.3.5/cups/transcode.c.1.3.x cups-1.3.5/cups/transcode.c
--- cups-1.3.5/cups/transcode.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/cups/transcode.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Transcoding support for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -132,8 +132,6 @@ _cupsCharmapFlush(void)
     vnext = vmap->next;
 
     free_vbcs_charmap(vmap);
-
-    free(vmap);
   }
 
   vmap_cache = NULL;
@@ -330,13 +328,8 @@ cupsCharsetToUTF8(
 
   if (encoding < CUPS_ENCODING_SBCS_END)
     bytes = conv_sbcs_to_utf8(dest, (cups_sbcs_t *)src, maxout, encoding);
-  else if (encoding < CUPS_ENCODING_VBCS_END)
-    bytes = conv_vbcs_to_utf8(dest, (cups_sbcs_t *)src, maxout, encoding);
   else
-  {
-    DEBUG_puts("    Bad encoding, returning -1");
-    bytes = -1;
-  }
+    bytes = conv_vbcs_to_utf8(dest, (cups_sbcs_t *)src, maxout, encoding);
 
 #ifdef HAVE_PTHREAD_H
   pthread_mutex_unlock(&map_mutex);
@@ -437,10 +430,8 @@ cupsUTF8ToCharset(
 
   if (encoding < CUPS_ENCODING_SBCS_END)
     bytes = conv_utf8_to_sbcs((cups_sbcs_t *)dest, src, maxout, encoding);
-  else if (encoding < CUPS_ENCODING_VBCS_END)
-    bytes = conv_utf8_to_vbcs((cups_sbcs_t *)dest, src, maxout, encoding);
   else
-    bytes = -1;
+    bytes = conv_utf8_to_vbcs((cups_sbcs_t *)dest, src, maxout, encoding);
 
 #ifdef HAVE_PTHREAD_H
   pthread_mutex_unlock(&map_mutex);
@@ -1468,6 +1459,8 @@ get_vbcs_charmap(
   {
     DEBUG_puts("    Unable to get charmap count!");
 
+    cupsFileClose(fp);
+
     return (NULL);
   }
 
@@ -1479,9 +1472,10 @@ get_vbcs_charmap(
 
   if ((vmap = (_cups_vmap_t *)calloc(1, sizeof(_cups_vmap_t))) == NULL)
   {
-    cupsFileClose(fp);
     DEBUG_puts("    Unable to allocate memory!");
 
+    cupsFileClose(fp);
+
     return (NULL);
   }
 
diff -up cups-1.3.5/cups/testcups.c.1.3.x cups-1.3.5/cups/testcups.c
--- cups-1.3.5/cups/testcups.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/cups/testcups.c	2008-02-14 13:03:30.000000000 +0000
@@ -106,6 +106,7 @@ main(int  argc,				/* I - Number of comm
   {
     status = 1;
     puts("FAIL");
+    return (1);
   }
   else
     puts("PASS");
diff -up cups-1.3.5/cups/http.c.1.3.x cups-1.3.5/cups/http.c
--- cups-1.3.5/cups/http.c.1.3.x	2007-07-25 21:39:33.000000000 +0100
+++ cups-1.3.5/cups/http.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   HTTP routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  *   This file contains Kerberos support code, copyright 2006 by
@@ -402,9 +402,11 @@ httpConnectEncrypt(
   * Allocate memory for the structure...
   */
 
-  http = calloc(sizeof(http_t), 1);
-  if (http == NULL)
+  if ((http = calloc(sizeof(http_t), 1)) == NULL)
+  {
+    httpAddrFreeList(addrlist);
     return (NULL);
+  }
 
   http->version  = HTTP_1_1;
   http->blocking = 1;
@@ -1735,9 +1737,15 @@ httpSetAuthString(http_t     *http,	/* I
     */
 
     int len = (int)strlen(scheme) + (data ? (int)strlen(data) + 1 : 0) + 1;
+    char *temp;
 
     if (len > (int)sizeof(http->_authstring))
-      http->authstring = malloc(len);
+    {
+      if ((temp = malloc(len)) == NULL)
+        len = sizeof(http->_authstring);
+      else
+        http->authstring = temp;
+    }
 
     if (data)
       snprintf(http->authstring, len, "%s %s", scheme, data);
diff -up cups-1.3.5/cups/libcups.exp.1.3.x cups-1.3.5/cups/libcups.exp
--- cups-1.3.5/cups/libcups.exp.1.3.x	2007-07-25 18:19:09.000000000 +0100
+++ cups-1.3.5/cups/libcups.exp	2008-02-14 13:03:30.000000000 +0000
@@ -1,6 +1,7 @@
 __cups_strcpy
 __cupsAdminGetServerSettings
 __cupsAdminSetServerSettings
+__cupsAppleLanguage
 __cupsCharmapFlush
 __cupsCharmapFree
 __cupsCharmapGet
diff -up cups-1.3.5/cups/request.c.1.3.x cups-1.3.5/cups/request.c
--- cups-1.3.5/cups/request.c.1.3.x	2007-07-24 01:13:05.000000000 +0100
+++ cups-1.3.5/cups/request.c	2008-02-14 13:03:30.000000000 +0000
@@ -17,6 +17,7 @@
  * Contents:
  *
  *   cupsDoFileRequest() - Do an IPP request with a file.
+ *   cupsDoIORequest()   - Do an IPP request with file descriptors.
  *   cupsDoRequest()     - Do an IPP request.
  *   _cupsSetError()     - Set the last IPP status code and status-message.
  *   _cupsSetHTTPError() - Set the last error using the HTTP status.
diff -up cups-1.3.5/cups/auth.c.1.3.x cups-1.3.5/cups/auth.c
--- cups-1.3.5/cups/auth.c.1.3.x	2007-10-31 18:35:56.000000000 +0000
+++ cups-1.3.5/cups/auth.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Authentication functions for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products.
  *
  *   This file contains Kerberos support code, copyright 2006 by
@@ -91,8 +91,7 @@ cupsDoAuthentication(http_t     *http,	/
   const char	*password;		/* Password string */
   char		prompt[1024],		/* Prompt for user */
 		realm[HTTP_MAX_VALUE],	/* realm="xyz" string */
-		nonce[HTTP_MAX_VALUE],	/* nonce="xyz" string */
-		encode[4096];		/* Encoded username:password */
+		nonce[HTTP_MAX_VALUE];	/* nonce="xyz" string */
   int		localauth;		/* Local authentication result */
   _cups_globals_t *cg;			/* Global data */
 
@@ -301,14 +300,40 @@ cupsDoAuthentication(http_t     *http,	/
     if (major_status == GSS_S_CONTINUE_NEEDED)
       DEBUG_gss_printf(major_status, minor_status, "Continuation needed!");
 
-    if (output_token.length)
+    if (output_token.length > 0 && output_token.length <= 65536)
     {
-      httpEncode64_2(encode, sizeof(encode), output_token.value,
+     /*
+      * Allocate the authorization string since Windows KDCs can have
+      * arbitrarily large credentials...
+      */
+
+      int authsize = 10 +				/* "Negotiate " */
+                     output_token.length * 4 / 3 + 1 +	/* Base64 */
+		     1;					/* nul */
+
+      httpSetAuthString(http, NULL, NULL);
+
+      if ((http->authstring = malloc(authsize)) == NULL)
+      {
+        http->authstring = http->_authstring;
+	authsize         = sizeof(http->_authstring);
+      }
+
+      strcpy(http->authstring, "Negotiate ");
+      httpEncode64_2(http->authstring + 10, authsize - 10, output_token.value,
 		     output_token.length);
-      httpSetAuthString(http, "Negotiate", encode);
  
       major_status = gss_release_buffer(&minor_status, &output_token);
     }
+    else
+    {
+      DEBUG_printf(("cupsDoAuthentication: Kerberos credentials too large - "
+                    "%d bytes!\n", output_token.length));
+
+      major_status = gss_release_buffer(&minor_status, &output_token);
+
+      return (-1);
+    }
 #endif /* HAVE_GSSAPI */
   }
   else if (strncmp(http->fields[HTTP_FIELD_WWW_AUTHENTICATE], "Digest", 6))
@@ -317,6 +342,9 @@ cupsDoAuthentication(http_t     *http,	/
     * Basic authentication...
     */
 
+    char	encode[256];		/* Base64 buffer */
+
+
     httpEncode64_2(encode, sizeof(encode), http->userpass,
                    (int)strlen(http->userpass));
     httpSetAuthString(http, "Basic", encode);
@@ -327,7 +355,8 @@ cupsDoAuthentication(http_t     *http,	/
     * Digest authentication...
     */
 
-    char digest[1024];			/* Digest auth data */
+    char	encode[33],		/* MD5 buffer */
+		digest[1024];		/* Digest auth data */
 
 
     httpGetSubField(http, HTTP_FIELD_WWW_AUTHENTICATE, "realm", realm);
diff -up cups-1.3.5/cups/options.c.1.3.x cups-1.3.5/cups/options.c
--- cups-1.3.5/cups/options.c.1.3.x	2007-07-20 22:28:10.000000000 +0100
+++ cups-1.3.5/cups/options.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Option routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -470,18 +470,28 @@ cupsParseOptions(
   char	*copyarg,			/* Copy of input string */
 	*ptr,				/* Pointer into string */
 	*name,				/* Pointer to name */
-	*value;				/* Pointer to value */
+	*value,				/* Pointer to value */
+	quote;				/* Quote character */
 
 
-  if (arg == NULL || options == NULL || num_options < 0)
+ /*
+  * Range check input...
+  */
+
+  if (!arg)
+    return (num_options);
+
+  if (!options || num_options < 0)
     return (0);
 
  /*
   * Make a copy of the argument string and then divide it up...
   */
 
-  copyarg     = strdup(arg);
-  ptr         = copyarg;
+  if ((copyarg = strdup(arg)) == NULL)
+    return (num_options);
+
+  ptr = copyarg;
 
  /*
   * Skip leading spaces...
@@ -501,7 +511,7 @@ cupsParseOptions(
     */
 
     name = ptr;
-    while (!isspace(*ptr & 255) && *ptr != '=' && *ptr != '\0')
+    while (!isspace(*ptr & 255) && *ptr != '=' && *ptr)
       ptr ++;
 
    /*
@@ -521,10 +531,10 @@ cupsParseOptions(
     if (*ptr != '=')
     {
      /*
-      * Start of another option...
+      * Boolean option...
       */
 
-      if (strncasecmp(name, "no", 2) == 0)
+      if (!strncasecmp(name, "no", 2))
         num_options = cupsAddOption(name + 2, "false", num_options,
 	                            options);
       else
@@ -539,38 +549,18 @@ cupsParseOptions(
 
     *ptr++ = '\0';
 
-    if (*ptr == '\'')
+    if (*ptr == '\'' || *ptr == '\"')
     {
      /*
       * Quoted string constant...
       */
 
-      ptr ++;
-      value = ptr;
-
-      while (*ptr != '\'' && *ptr != '\0')
-      {
-        if (*ptr == '\\')
-	  _cups_strcpy(ptr, ptr + 1);
-
-        ptr ++;
-      }
-
-      if (*ptr != '\0')
-        *ptr++ = '\0';
-    }
-    else if (*ptr == '\"')
-    {
-     /*
-      * Double-quoted string constant...
-      */
-
-      ptr ++;
+      quote = *ptr++;
       value = ptr;
 
-      while (*ptr != '\"' && *ptr != '\0')
+      while (*ptr != quote && *ptr)
       {
-        if (*ptr == '\\')
+        if (*ptr == '\\' && ptr[1])
 	  _cups_strcpy(ptr, ptr + 1);
 
         ptr ++;
@@ -603,7 +593,7 @@ cupsParseOptions(
 	      break;
 	  }
         }
-        else if (*ptr == '\\')
+        else if (*ptr == '\\' && ptr[1])
 	  _cups_strcpy(ptr, ptr + 1);
 
       if (*ptr != '\0')
@@ -617,9 +607,9 @@ cupsParseOptions(
 
       value = ptr;
 
-      while (!isspace(*ptr & 255) && *ptr != '\0')
+      while (!isspace(*ptr & 255) && *ptr)
       {
-        if (*ptr == '\\')
+        if (*ptr == '\\' && ptr[1])
 	  _cups_strcpy(ptr, ptr + 1);
 
         ptr ++;
diff -up cups-1.3.5/cups/i18n.h.1.3.x cups-1.3.5/cups/i18n.h
--- cups-1.3.5/cups/i18n.h.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/cups/i18n.h	2008-02-14 13:03:30.000000000 +0000
@@ -82,6 +82,10 @@ typedef struct _cups_vmap_s		/**** VBCS 
  * Prototypes...
  */
 
+#ifdef __APPLE__
+extern const char	*_cupsAppleLanguage(const char *locale, char *language,
+			                    size_t langsize);
+#endif /* __APPLE__ */
 extern void		_cupsCharmapFlush(void);
 extern void		_cupsCharmapFree(const cups_encoding_t encoding);
 extern void		*_cupsCharmapGet(const cups_encoding_t encoding);
diff -up cups-1.3.5/cups/util.c.1.3.x cups-1.3.5/cups/util.c
--- cups-1.3.5/cups/util.c.1.3.x	2007-10-10 23:00:43.000000000 +0100
+++ cups-1.3.5/cups/util.c	2008-02-14 13:03:30.000000000 +0000
@@ -846,9 +846,6 @@ cupsGetPPD2(http_t     *http,		/* I - HT
 
   close(fd);
 
-  if (http2 != http)
-    httpClose(http2);
-
  /*
   * See if we actually got the file or an error...
   */
@@ -877,6 +874,9 @@ cupsGetPPD2(http_t     *http,		/* I - HT
     return (NULL);
   }
 
+  if (http2 != http)
+    httpClose(http2);
+
  /*
   * Return the PPD file...
   */
diff -up cups-1.3.5/cups/language.c.1.3.x cups-1.3.5/cups/language.c
--- cups-1.3.5/cups/language.c.1.3.x	2007-10-31 18:51:08.000000000 +0000
+++ cups-1.3.5/cups/language.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   I18N/language support for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -16,6 +16,8 @@
  *
  * Contents:
  *
+ *   _cupsAppleLanguage()   - Get the Apple language identifier associated
+ *                            with a locale ID.
  *   _cupsEncodingName()    - Return the character encoding name string
  *                            for the given encoding enumeration.
  *   cupsLangDefault()      - Return the default language.
@@ -65,26 +67,6 @@ static pthread_mutex_t	lang_mutex = PTHR
 #endif /* HAVE_PTHREAD_H */
 static cups_lang_t	*lang_cache = NULL;
 					/* Language string cache */
-
-
-/*
- * Local functions...
- */
-
-#ifdef __APPLE__
-static const char	*appleLangDefault(void);
-#endif /* __APPLE__ */
-static cups_lang_t	*cups_cache_lookup(const char *name,
-			                   cups_encoding_t encoding);
-static int		cups_message_compare(_cups_message_t *m1,
-			                     _cups_message_t *m2);
-static void		cups_unquote(char *d, const char *s);
-
-
-/*
- * Local globals...
- */
-
 static const char * const lang_encodings[] =
 			{		/* Encoding strings */
 			  "us-ascii",		"iso-8859-1",
@@ -155,6 +137,123 @@ static const char * const lang_encodings
 			  "euc-kr",		"euc-tw"
 			};
 
+#ifdef __APPLE__
+typedef struct
+{
+  const char * const language;		/* Language ID */
+  const char * const locale;		/* Locale ID */
+} _apple_language_locale_t;
+
+static const _apple_language_locale_t apple_language_locale[] =
+{					/* Locale to language ID LUT */
+  { "en"	, "en_US" },
+  { "nb"	, "no"    },
+  { "zh-Hans"	, "zh_CN" },
+  { "zh-Hant"	, "zh_TW" }
+};
+#endif /* __APPLE__ */
+
+
+/*
+ * Local functions...
+ */
+
+#ifdef __APPLE__
+static const char	*appleLangDefault(void);
+#endif /* __APPLE__ */
+static cups_lang_t	*cups_cache_lookup(const char *name,
+			                   cups_encoding_t encoding);
+static int		cups_message_compare(_cups_message_t *m1,
+			                     _cups_message_t *m2);
+static void		cups_unquote(char *d, const char *s);
+
+
+#ifdef __APPLE__
+/*
+ *   _cupsAppleLanguage()   - Get the Apple language identifier associated
+ *                            with a locale ID.
+ */
+
+const char *				/* O - Language ID */
+_cupsAppleLanguage(const char *locale,	/* I - Locale ID */
+                   char       *language,/* I - Language ID buffer */
+                   size_t     langsize)	/* I - Size of language ID buffer */
+{
+  int		i;			/* Looping var */
+  CFStringRef	localeid,		/* CF locale identifier */
+		langid;			/* CF language identifier */
+
+
+ /*
+  * Copy the locale name and convert, as needed, to the Apple-specific
+  * locale identifier...
+  */
+
+  switch (strlen(locale))
+  {
+    default :
+        /*
+	 * Invalid locale...
+	 */
+
+	 strlcpy(language, "en", langsize);
+	 break;
+
+    case 2 :
+        strlcpy(language, locale, langsize);
+        break;
+
+    case 5 :
+        strlcpy(language, locale, langsize);
+
+	if (language[2] == '-')
+	{
+	 /*
+	  * Convert ll-cc to ll_CC...
+	  */
+
+	  language[2] = '_';
+	  language[3] = toupper(language[3] & 255);
+	  language[4] = toupper(language[4] & 255);
+	}
+	break;
+  }
+
+  for (i = 0;
+       i < (int)(sizeof(apple_language_locale) /
+		 sizeof(apple_language_locale[0]));
+       i ++)
+    if (!strcmp(locale, apple_language_locale[i].locale))
+    {
+      strlcpy(language, apple_language_locale[i].language, sizeof(language));
+      break;
+    }
+
+ /*
+  * Attempt to map the locale ID to a language ID...
+  */
+
+  if ((localeid = CFStringCreateWithCString(kCFAllocatorDefault, language,
+                                            kCFStringEncodingASCII)) != NULL)
+  {
+    if ((langid = CFLocaleCreateCanonicalLanguageIdentifierFromString(
+                      kCFAllocatorDefault, localeid)) != NULL)
+    {
+      CFStringGetCString(langid, language, langsize, kCFStringEncodingASCII);
+      CFRelease(langid);
+    }
+
+    CFRelease(localeid);
+  }
+
+ /*
+  * Return what we got...
+  */
+
+  return (language);
+}
+#endif /* __APPLE__ */
+
 
 /*
  * '_cupsEncodingName()' - Return the character encoding name string
@@ -876,7 +975,12 @@ _cupsMessageLoad(const char *filename)	/
 	return (a);
       }
 
-      m->id = strdup(ptr);
+      if ((m->id = strdup(ptr)) == NULL)
+      {
+        free(m);
+        cupsFileClose(fp);
+	return (a);
+      }
     }
     else if (s[0] == '\"' && m)
     {
@@ -924,7 +1028,11 @@ _cupsMessageLoad(const char *filename)	/
       * Set the string...
       */
 
-      m->str = strdup(ptr);
+      if ((m->str = strdup(ptr)) == NULL)
+      {
+        cupsFileClose(fp);
+	return (a);
+      }
     }
   }
 
@@ -974,30 +1082,6 @@ _cupsMessageLookup(cups_array_t *a,	/* I
 
 #ifdef __APPLE__
 /*
- * Code & data to translate OSX's language names to their ISO 639-1 locale.
- *
- * The first version uses the new CoreFoundation API added in 10.3 (Panther),
- * the second is for 10.2 (Jaguar).
- */
-
-#  ifdef HAVE_CF_LOCALE_ID
-
-typedef struct
-{
-  const char * const name;		/* Language name */
-  const char * const locale;		/* Locale name */
-} _apple_name_locale_t;
-
-static const _apple_name_locale_t apple_name_locale[] =
-{
-  { "en"	, "en_US" },
-  { "nb"	, "no"    },
-  { "zh-Hans"	, "zh_CN" },
-  { "zh-Hant"	, "zh_TW" }
-};
-
-
-/*
  * 'appleLangDefault()' - Get the default locale string.
  */
 
@@ -1067,14 +1151,15 @@ appleLangDefault(void)
 	    */
 
 	    for (i = 0;
-		 i < sizeof(apple_name_locale) / sizeof(apple_name_locale[0]);
-		 i++)
+		 i < (int)(sizeof(apple_language_locale) /
+		           sizeof(apple_language_locale[0]));
+		 i ++)
 	    {
-	      if (!strcmp(cg->language, apple_name_locale[i].name))
+	      if (!strcmp(cg->language, apple_language_locale[i].language))
 	      {
 		DEBUG_printf(("appleLangDefault: mapping \"%s\" to \"%s\"...\n",
-			      cg->language, apple_name_locale[i].locale));
-		strlcpy(cg->language, apple_name_locale[i].locale, 
+			      cg->language, apple_language_locale[i].locale));
+		strlcpy(cg->language, apple_language_locale[i].locale, 
 			sizeof(cg->language));
 		break;
 	      }
@@ -1110,166 +1195,6 @@ appleLangDefault(void)
 
   return (cg->language);
 }
-#  else
-/*
- * Code & data to translate OSX 10.2's language names to their ISO 639-1
- * locale.
- */
-
-typedef struct
-{
-  const char * const name;		/* Language name */
-  const char * const locale;		/* Locale name */
-} _apple_name_locale_t;
-
-static const _apple_name_locale_t apple_name_locale[] =
-{
-  { "English"     , "en_US.UTF-8" },	{ "French"     , "fr.UTF-8" },
-  { "German"      , "de.UTF-8" },	{ "Italian"    , "it.UTF-8" },  
-  { "Dutch"       , "nl.UTF-8" },	{ "Swedish"    , "sv.UTF-8" },
-  { "Spanish"     , "es.UTF-8" },	{ "Danish"     , "da.UTF-8" },  
-  { "Portuguese"  , "pt.UTF-8" },	{ "Norwegian"  , "no.UTF-8" },
-  { "Hebrew"      , "he.UTF-8" },	{ "Japanese"   , "ja.UTF-8" },  
-  { "Arabic"      , "ar.UTF-8" },	{ "Finnish"    , "fi.UTF-8" },
-  { "Greek"       , "el.UTF-8" },	{ "Icelandic"  , "is.UTF-8" },  
-  { "Maltese"     , "mt.UTF-8" },	{ "Turkish"    , "tr.UTF-8" },
-  { "Croatian"    , "hr.UTF-8" },	{ "Chinese"    , "zh.UTF-8" },  
-  { "Urdu"        , "ur.UTF-8" },	{ "Hindi"      , "hi.UTF-8" },
-  { "Thai"        , "th.UTF-8" },	{ "Korean"     , "ko.UTF-8" },  
-  { "Lithuanian"  , "lt.UTF-8" },	{ "Polish"     , "pl.UTF-8" },
-  { "Hungarian"   , "hu.UTF-8" },	{ "Estonian"   , "et.UTF-8" },  
-  { "Latvian"     , "lv.UTF-8" },	{ "Sami"       , "se.UTF-8" },
-  { "Faroese"     , "fo.UTF-8" },	{ "Farsi"      , "fa.UTF-8" },  
-  { "Russian"     , "ru.UTF-8" },	{ "Chinese"    , "zh.UTF-8" },
-  { "Dutch"       , "nl.UTF-8" },	{ "Irish"      , "ga.UTF-8" },  
-  { "Albanian"    , "sq.UTF-8" },	{ "Romanian"   , "ro.UTF-8" },
-  { "Czech"       , "cs.UTF-8" },	{ "Slovak"     , "sk.UTF-8" },  
-  { "Slovenian"   , "sl.UTF-8" },	{ "Yiddish"    , "yi.UTF-8" },
-  { "Serbian"     , "sr.UTF-8" },	{ "Macedonian" , "mk.UTF-8" },  
-  { "Bulgarian"   , "bg.UTF-8" },	{ "Ukrainian"  , "uk.UTF-8" },
-  { "Byelorussian", "be.UTF-8" },	{ "Uzbek"      , "uz.UTF-8" },  
-  { "Kazakh"      , "kk.UTF-8" },	{ "Azerbaijani", "az.UTF-8" },
-  { "Azerbaijani" , "az.UTF-8" },	{ "Armenian"   , "hy.UTF-8" },  
-  { "Georgian"    , "ka.UTF-8" },	{ "Moldavian"  , "mo.UTF-8" },
-  { "Kirghiz"     , "ky.UTF-8" },	{ "Tajiki"     , "tg.UTF-8" },  
-  { "Turkmen"     , "tk.UTF-8" },	{ "Mongolian"  , "mn.UTF-8" },
-  { "Mongolian"   , "mn.UTF-8" },	{ "Pashto"     , "ps.UTF-8" },  
-  { "Kurdish"     , "ku.UTF-8" },	{ "Kashmiri"   , "ks.UTF-8" },
-  { "Sindhi"      , "sd.UTF-8" },	{ "Tibetan"    , "bo.UTF-8" },  
-  { "Nepali"      , "ne.UTF-8" },	{ "Sanskrit"   , "sa.UTF-8" },
-  { "Marathi"     , "mr.UTF-8" },	{ "Bengali"    , "bn.UTF-8" },  
-  { "Assamese"    , "as.UTF-8" },	{ "Gujarati"   , "gu.UTF-8" },
-  { "Punjabi"     , "pa.UTF-8" },	{ "Oriya"      , "or.UTF-8" },  
-  { "Malayalam"   , "ml.UTF-8" },	{ "Kannada"    , "kn.UTF-8" },
-  { "Tamil"       , "ta.UTF-8" },	{ "Telugu"     , "te.UTF-8" },  
-  { "Sinhalese"   , "si.UTF-8" },	{ "Burmese"    , "my.UTF-8" },
-  { "Khmer"       , "km.UTF-8" },	{ "Lao"        , "lo.UTF-8" },  
-  { "Vietnamese"  , "vi.UTF-8" },	{ "Indonesian" , "id.UTF-8" },
-  { "Tagalog"     , "tl.UTF-8" },	{ "Malay"      , "ms.UTF-8" },  
-  { "Malay"       , "ms.UTF-8" },	{ "Amharic"    , "am.UTF-8" },
-  { "Tigrinya"    , "ti.UTF-8" },	{ "Oromo"      , "om.UTF-8" },  
-  { "Somali"      , "so.UTF-8" },	{ "Swahili"    , "sw.UTF-8" },
-  { "Kinyarwanda" , "rw.UTF-8" },	{ "Rundi"      , "rn.UTF-8" },  
-  { "Nyanja"      , "" },		{ "Malagasy"   , "mg.UTF-8" },
-  { "Esperanto"   , "eo.UTF-8" },	{ "Welsh"      , "cy.UTF-8" },  
-  { "Basque"      , "eu.UTF-8" },	{ "Catalan"    , "ca.UTF-8" },
-  { "Latin"       , "la.UTF-8" },	{ "Quechua"    , "qu.UTF-8" },  
-  { "Guarani"     , "gn.UTF-8" },	{ "Aymara"     , "ay.UTF-8" },
-  { "Tatar"       , "tt.UTF-8" },	{ "Uighur"     , "ug.UTF-8" },  
-  { "Dzongkha"    , "dz.UTF-8" },	{ "Javanese"   , "jv.UTF-8" },
-  { "Sundanese"   , "su.UTF-8" },	{ "Galician"   , "gl.UTF-8" },  
-  { "Afrikaans"   , "af.UTF-8" },	{ "Breton"     , "br.UTF-8" },
-  { "Inuktitut"   , "iu.UTF-8" },	{ "Scottish"   , "gd.UTF-8" },  
-  { "Manx"        , "gv.UTF-8" },	{ "Irish"      , "ga.UTF-8" },
-  { "Tongan"      , "to.UTF-8" },	{ "Greek"      , "el.UTF-8" },  
-  { "Greenlandic" , "kl.UTF-8" },	{ "Azerbaijani", "az.UTF-8" }
-};
-
-
-/*
- * 'appleLangDefault()' - Get the default locale string.
- */
-
-static const char *			/* O - Locale string */
-appleLangDefault(void)
-{
-  int			i;		/* Looping var */
-  CFPropertyListRef 	localizationList;
-					/* List of localization data */
-  CFStringRef		localizationName;
-					/* Current name */
-  char			buff[256];	/* Temporary buffer */
-  _cups_globals_t	*cg = _cupsGlobals();
-  					/* Pointer to library globals */
-  char			*lang;		/* LANG environment variable */
-
-
- /*
-  * Only do the lookup and translation the first time.
-  */
-
-  if (!cg->language[0])
-  {
-    if ((lang = getenv("LANG")))
-      strlcpy(cg->language, lang, sizeof(cg->language));
-    else
-    {
-      localizationList =
-          CFPreferencesCopyAppValue(CFSTR("AppleLanguages"),
-                                    kCFPreferencesCurrentApplication);
-
-      if (localizationList != NULL)
-      {
-	if (CFGetTypeID(localizationList) == CFArrayGetTypeID() &&
-	    CFArrayGetCount(localizationList) > 0)
-	{
-	  localizationName = CFArrayGetValueAtIndex(localizationList, 0);
-
-	  if (localizationName != NULL &&
-              CFGetTypeID(localizationName) == CFStringGetTypeID())
-	  {
-	    CFIndex length = CFStringGetLength(localizationName);
-
-	    if (length <= sizeof(buff) &&
-		CFStringGetCString(localizationName, buff, sizeof(buff),
-	                           kCFStringEncodingASCII))
-	    {
-	      buff[sizeof(buff) - 1] = '\0';
-
-	      for (i = 0;
-		   i < sizeof(apple_name_locale) / sizeof(apple_name_locale[0]);
-		   i++)
-	      {
-		if (!strcasecmp(buff, apple_name_locale[i].name))
-		{
-		  strlcpy(cg->language, apple_name_locale[i].locale, 
-			  sizeof(cg->language));
-		  break;
-		}
-	      }
-	    }
-	  }
-	}
-
-	CFRelease(localizationList);
-      }
-    }
-  
-   /*
-    * If we didn't find the language, default to en_US...
-    */
-
-    if (!cg->language[0])
-      strlcpy(cg->language, apple_name_locale[0].locale, sizeof(cg->language));
-  }
-
- /*
-  * Return the cached locale...
-  */
-
-  return (cg->language);
-}
-#  endif /* HAVE_CF_LOCALE_ID */
 #endif /* __APPLE__ */
 
 
diff -up cups-1.3.5/cups/emit.c.1.3.x cups-1.3.5/cups/emit.c
--- cups-1.3.5/cups/emit.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/cups/emit.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   PPD code emission routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -106,15 +106,24 @@ ppdCollect2(ppd_file_t    *ppd,		/* I - 
   DEBUG_printf(("ppdCollect2(ppd=%p, section=%d, min_order=%f, choices=%p)\n",
                 ppd, section, min_order, choices));
 
-  if (ppd == NULL)
+  if (!ppd || !choices)
+  {
+    if (choices)
+      *choices = NULL;
+
     return (0);
+  }
 
  /*
   * Allocate memory for up to 1000 selected choices...
   */
 
-  count   = 0;
-  collect = calloc(sizeof(ppd_choice_t *), 1000);
+  count = 0;
+  if ((collect = calloc(sizeof(ppd_choice_t *), 1000)) == NULL)
+  {
+    *choices = NULL;
+    return (0);
+  }
 
  /*
   * Loop through all options and add choices as needed...
diff -up cups-1.3.5/cups/ipp-private.h.1.3.x cups-1.3.5/cups/ipp-private.h
--- cups-1.3.5/cups/ipp-private.h.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/cups/ipp-private.h	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Private IPP definitions for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2006 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -40,6 +40,7 @@ extern "C" {
 
 typedef struct				/**** Attribute mapping data ****/
 {
+  int		multivalue;		/* Option has multiple values? */
   const char	*name;			/* Option/attribute name */
   ipp_tag_t	value_tag;		/* Value tag for this attribute */
   ipp_tag_t	group_tag;		/* Group tag for this attribute */
diff -up cups-1.3.5/cups/http-addrlist.c.1.3.x cups-1.3.5/cups/http-addrlist.c
--- cups-1.3.5/cups/http-addrlist.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/cups/http-addrlist.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   HTTP address list routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -202,9 +202,11 @@ httpAddrGetList(const char *hostname,	/*
     * Domain socket address...
     */
 
-    first = (http_addrlist_t *)calloc(1, sizeof(http_addrlist_t));
-    first->addr.un.sun_family = AF_LOCAL;
-    strlcpy(first->addr.un.sun_path, hostname, sizeof(first->addr.un.sun_path));
+    if ((first = (http_addrlist_t *)calloc(1, sizeof(http_addrlist_t))) != NULL)
+    {
+      first->addr.un.sun_family = AF_LOCAL;
+      strlcpy(first->addr.un.sun_path, hostname, sizeof(first->addr.un.sun_path));
+    }
   }
   else
 #endif /* AF_LOCAL */
diff -up cups-1.3.5/cups/http-private.h.1.3.x cups-1.3.5/cups/http-private.h
--- cups-1.3.5/cups/http-private.h.1.3.x	2007-09-10 17:46:20.000000000 +0100
+++ cups-1.3.5/cups/http-private.h	2008-02-14 13:03:30.000000000 +0000
@@ -26,12 +26,6 @@
 #  include <config.h>
 
 #  ifdef __sun
-/*
- * Define FD_SETSIZE to CUPS_MAX_FDS on Solaris to get the correct version of
- * select() for large numbers of file descriptors.
- */
-
-#    define FD_SETSIZE	CUPS_MAX_FDS
 #    include <sys/select.h>
 #  endif /* __sun */
 
diff -up cups-1.3.5/cups/ppd.c.1.3.x cups-1.3.5/cups/ppd.c
--- cups-1.3.5/cups/ppd.c.1.3.x	2007-11-30 19:29:50.000000000 +0000
+++ cups-1.3.5/cups/ppd.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   PPD file routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -814,6 +814,13 @@ ppdOpen2(cups_file_t *fp)		/* I - File t
         profile = realloc(ppd->profiles, sizeof(ppd_profile_t) *
 	                                 (ppd->num_profiles + 1));
 
+      if (!profile)
+      {
+        cg->ppd_status = PPD_ALLOC_ERROR;
+
+	goto error;
+      }
+
       ppd->profiles     = profile;
       profile           += ppd->num_profiles;
       ppd->num_profiles ++;
@@ -1102,7 +1109,12 @@ ppdOpen2(cups_file_t *fp)		/* I - File t
 	}
 
       ppd->num_emulations = count;
-      ppd->emulations     = calloc(count, sizeof(ppd_emul_t));
+      if ((ppd->emulations = calloc(count, sizeof(ppd_emul_t))) == NULL)
+      {
+        cg->ppd_status = PPD_ALLOC_ERROR;
+
+	goto error;
+      }
 
       for (i = 0, sptr = string; i < count; i ++)
       {
@@ -1866,7 +1878,12 @@ ppdOpen2(cups_file_t *fp)		/* I - File t
       * Add the option choice...
       */
 
-      choice = ppd_add_choice(option, name);
+      if ((choice = ppd_add_choice(option, name)) == NULL)
+      {
+        cg->ppd_status = PPD_ALLOC_ERROR;
+
+	goto error;
+      }
 
       if (text[0])
         cupsCharsetToUTF8((cups_utf8_t *)choice->text, text,
diff -up cups-1.3.5/cups/cups.h.1.3.x cups-1.3.5/cups/cups.h
--- cups-1.3.5/cups/cups.h.1.3.x	2007-11-01 23:29:14.000000000 +0000
+++ cups-1.3.5/cups/cups.h	2008-02-14 13:03:30.000000000 +0000
@@ -59,10 +59,10 @@ extern "C" {
  * Constants...
  */
 
-#  define CUPS_VERSION		1.0305
+#  define CUPS_VERSION		1.0306
 #  define CUPS_VERSION_MAJOR	1
 #  define CUPS_VERSION_MINOR	3
-#  define CUPS_VERSION_PATCH	5
+#  define CUPS_VERSION_PATCH	6
 #  define CUPS_DATE_ANY		-1
 
 
diff -up cups-1.3.5/cups/ipp.c.1.3.x cups-1.3.5/cups/ipp.c
--- cups-1.3.5/cups/ipp.c.1.3.x	2007-10-31 18:35:56.000000000 +0000
+++ cups-1.3.5/cups/ipp.c	2008-02-14 13:03:30.000000000 +0000
@@ -4,7 +4,7 @@
  *   Internet Printing Protocol support functions for the Common UNIX
  *   Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -361,7 +361,12 @@ ippAddOctetString(ipp_t      *ipp,	/* I 
 
   if (data)
   {
-    attr->values[0].unknown.data = malloc(datalen);
+    if ((attr->values[0].unknown.data = malloc(datalen)) == NULL)
+    {
+      ippDeleteAttribute(ipp, attr);
+      return (NULL);
+    }
+
     memcpy(attr->values[0].unknown.data, data, datalen);
   }
 
@@ -1182,17 +1187,15 @@ ippReadIO(void       *src,		/* I - Data 
 
 	      attr->value_tag = tag;
 	    }
-	    else if (value_tag == IPP_TAG_STRING ||
-    		     (value_tag >= IPP_TAG_TEXTLANG &&
-		      value_tag <= IPP_TAG_MIMETYPE))
+	    else if (value_tag >= IPP_TAG_TEXTLANG &&
+		     value_tag <= IPP_TAG_MIMETYPE)
             {
 	     /*
 	      * String values can sometimes come across in different
 	      * forms; accept sets of differing values...
 	      */
 
-	      if (tag != IPP_TAG_STRING &&
-    		  (tag < IPP_TAG_TEXTLANG || tag > IPP_TAG_MIMETYPE))
+	      if (tag < IPP_TAG_TEXTLANG || tag > IPP_TAG_MIMETYPE)
 	        return (IPP_ERROR);
             }
 	    else if (value_tag != tag)
@@ -1277,7 +1280,11 @@ ippReadIO(void       *src,		/* I - Data 
             if (ipp->current)
 	      ipp->prev = ipp->current;
 
-	    attr = ipp->current = _ippAddAttr(ipp, 1);
+	    if ((attr = ipp->current = _ippAddAttr(ipp, 1)) == NULL)
+	    {
+	      DEBUG_puts("ippReadIO: unable to allocate attribute!");
+	      return (IPP_ERROR);
+	    }
 
 	    DEBUG_printf(("ippReadIO: name=\'%s\', ipp->current=%p, ipp->prev=%p\n",
 	                  buffer, ipp->current, ipp->prev));
@@ -1325,6 +1332,7 @@ ippReadIO(void       *src,		/* I - Data 
 
                 value->integer = n;
 	        break;
+
 	    case IPP_TAG_BOOLEAN :
 		if (n != 1)
 		{
@@ -1340,10 +1348,10 @@ ippReadIO(void       *src,		/* I - Data 
 
                 value->boolean = buffer[0];
 	        break;
+
 	    case IPP_TAG_TEXT :
 	    case IPP_TAG_NAME :
 	    case IPP_TAG_KEYWORD :
-	    case IPP_TAG_STRING :
 	    case IPP_TAG_URI :
 	    case IPP_TAG_URISCHEME :
 	    case IPP_TAG_CHARSET :
@@ -1366,6 +1374,7 @@ ippReadIO(void       *src,		/* I - Data 
 		DEBUG_printf(("ippReadIO: value = \'%s\'\n",
 		              value->string.text));
 	        break;
+
 	    case IPP_TAG_DATE :
 		if (n != 11)
 		{
@@ -1379,6 +1388,7 @@ ippReadIO(void       *src,		/* I - Data 
 		  return (IPP_ERROR);
 		}
 	        break;
+
 	    case IPP_TAG_RESOLUTION :
 		if (n != 9)
 		{
@@ -1401,6 +1411,7 @@ ippReadIO(void       *src,		/* I - Data 
                 value->resolution.units =
 		    (ipp_res_t)buffer[8];
 	        break;
+
 	    case IPP_TAG_RANGE :
 		if (n != 8)
 		{
@@ -1421,6 +1432,7 @@ ippReadIO(void       *src,		/* I - Data 
 		    (((((buffer[4] << 8) | buffer[5]) << 8) | buffer[6]) << 8) |
 		    buffer[7];
 	        break;
+
 	    case IPP_TAG_TEXTLANG :
 	    case IPP_TAG_NAMELANG :
 	        if (n >= sizeof(buffer) || n < 4)
@@ -1538,7 +1550,7 @@ ippReadIO(void       *src,		/* I - Data 
 		break;
 
             default : /* Other unsupported values */
-		if (n > sizeof(buffer))
+		if (n > IPP_MAX_LENGTH)
 		{
 		  DEBUG_printf(("ippReadIO: bad value length %d!\n", n));
 		  return (IPP_ERROR);
@@ -1547,7 +1559,12 @@ ippReadIO(void       *src,		/* I - Data 
                 value->unknown.length = n;
 	        if (n > 0)
 		{
-		  value->unknown.data = malloc(n);
+		  if ((value->unknown.data = malloc(n)) == NULL)
+		  {
+		    DEBUG_puts("ippReadIO: Unable to allocate value");
+		    return (IPP_ERROR);
+		  }
+
 	          if ((*cb)(src, value->unknown.data, n) < n)
 		  {
 	            DEBUG_puts("ippReadIO: Unable to read unsupported value!");
@@ -1941,7 +1958,6 @@ ippWriteIO(void       *dst,		/* I - Dest
 	    case IPP_TAG_TEXT :
 	    case IPP_TAG_NAME :
 	    case IPP_TAG_KEYWORD :
-	    case IPP_TAG_STRING :
 	    case IPP_TAG_URI :
 	    case IPP_TAG_URISCHEME :
 	    case IPP_TAG_CHARSET :
@@ -2507,7 +2523,6 @@ _ippFreeAttr(ipp_attribute_t *attr)	/* I
     case IPP_TAG_TEXT :
     case IPP_TAG_NAME :
     case IPP_TAG_KEYWORD :
-    case IPP_TAG_STRING :
     case IPP_TAG_URI :
     case IPP_TAG_URISCHEME :
     case IPP_TAG_CHARSET :
@@ -2546,6 +2561,13 @@ _ippFreeAttr(ipp_attribute_t *attr)	/* I
           ippDelete(value->collection);
 	break;
 
+    case IPP_TAG_STRING :
+	for (i = 0, value = attr->values;
+	     i < attr->num_values;
+	     i ++, value ++)
+	  free(value->unknown.data);
+        break;
+
     default :
         if (!((int)attr->value_tag & IPP_TAG_COPY))
 	{
@@ -2634,7 +2656,6 @@ ipp_length(ipp_t *ipp,			/* I - IPP mess
       case IPP_TAG_TEXT :
       case IPP_TAG_NAME :
       case IPP_TAG_KEYWORD :
-      case IPP_TAG_STRING :
       case IPP_TAG_URI :
       case IPP_TAG_URISCHEME :
       case IPP_TAG_CHARSET :
diff -up cups-1.3.5/cups/encode.c.1.3.x cups-1.3.5/cups/encode.c
--- cups-1.3.5/cups/encode.c.1.3.x	2007-11-02 19:15:27.000000000 +0000
+++ cups-1.3.5/cups/encode.c	2008-02-14 13:03:30.000000000 +0000
@@ -43,98 +43,98 @@
 
 static const _ipp_option_t ipp_options[] =
 {
-  { "auth-info",		IPP_TAG_TEXT,		IPP_TAG_JOB },
-  { "auth-info-required",	IPP_TAG_KEYWORD,	IPP_TAG_PRINTER },
-  { "blackplot",		IPP_TAG_BOOLEAN,	IPP_TAG_JOB },
-  { "blackplot-default",	IPP_TAG_BOOLEAN,	IPP_TAG_PRINTER },
-  { "brightness",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
-  { "brightness-default",	IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
-  { "columns",			IPP_TAG_INTEGER,	IPP_TAG_JOB },
-  { "columns-default",		IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
-  { "copies",			IPP_TAG_INTEGER,	IPP_TAG_JOB },
-  { "copies-default",		IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
-  { "document-format",		IPP_TAG_MIMETYPE,	IPP_TAG_OPERATION },
-  { "document-format-default",	IPP_TAG_MIMETYPE,	IPP_TAG_PRINTER },
-  { "finishings",		IPP_TAG_ENUM,		IPP_TAG_JOB },
-  { "finishings-default",	IPP_TAG_ENUM,		IPP_TAG_PRINTER },
-  { "fitplot",			IPP_TAG_BOOLEAN,	IPP_TAG_JOB },
-  { "fitplot-default",		IPP_TAG_BOOLEAN,	IPP_TAG_PRINTER },
-  { "gamma",			IPP_TAG_INTEGER,	IPP_TAG_JOB },
-  { "gamma-default",		IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
-  { "hue",			IPP_TAG_INTEGER,	IPP_TAG_JOB },
-  { "hue-default",		IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
-  { "job-k-limit",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
-  { "job-page-limit",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
-  { "job-priority",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
-  { "job-quota-period",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
-  { "job-uuid",			IPP_TAG_URI,		IPP_TAG_JOB },
-  { "landscape",		IPP_TAG_BOOLEAN,	IPP_TAG_JOB },
-  { "media",			IPP_TAG_KEYWORD,	IPP_TAG_JOB },
-  { "mirror",			IPP_TAG_BOOLEAN,	IPP_TAG_JOB },
-  { "mirror-default",		IPP_TAG_BOOLEAN,	IPP_TAG_PRINTER },
-  { "natural-scaling",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
-  { "natural-scaling-default",	IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
-  { "notify-charset",		IPP_TAG_CHARSET,	IPP_TAG_SUBSCRIPTION },
-  { "notify-events",		IPP_TAG_KEYWORD,	IPP_TAG_SUBSCRIPTION },
-  { "notify-events-default",	IPP_TAG_KEYWORD,	IPP_TAG_PRINTER },
-  { "notify-lease-duration",	IPP_TAG_INTEGER,	IPP_TAG_SUBSCRIPTION },
-  { "notify-lease-duration-default", IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
-  { "notify-natural-language",	IPP_TAG_LANGUAGE,	IPP_TAG_SUBSCRIPTION },
-  { "notify-pull-method",	IPP_TAG_KEYWORD,	IPP_TAG_SUBSCRIPTION },
-  { "notify-recipient-uri",	IPP_TAG_URI,		IPP_TAG_SUBSCRIPTION },
-  { "notify-time-interval",	IPP_TAG_INTEGER,	IPP_TAG_SUBSCRIPTION },
-  { "notify-user-data",		IPP_TAG_STRING,		IPP_TAG_SUBSCRIPTION },
-  { "number-up",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
-  { "number-up-default",	IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
-  { "orientation-requested",	IPP_TAG_ENUM,		IPP_TAG_JOB },
-  { "orientation-requested-default", IPP_TAG_ENUM,	IPP_TAG_PRINTER },
-  { "page-bottom",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
-  { "page-bottom-default",	IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
-  { "page-left",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
-  { "page-left-default",	IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
-  { "page-ranges",		IPP_TAG_RANGE,		IPP_TAG_JOB },
-  { "page-ranges-default",	IPP_TAG_RANGE,		IPP_TAG_PRINTER },
-  { "page-right",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
-  { "page-right-default",	IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
-  { "page-top",			IPP_TAG_INTEGER,	IPP_TAG_JOB },
-  { "page-top-default",		IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
-  { "penwidth",			IPP_TAG_INTEGER,	IPP_TAG_JOB },
-  { "penwidth-default",		IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
-  { "port-monitor",             IPP_TAG_NAME,           IPP_TAG_PRINTER },
-  { "ppi",			IPP_TAG_INTEGER,	IPP_TAG_JOB },
-  { "ppi-default",		IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
-  { "prettyprint",		IPP_TAG_BOOLEAN,	IPP_TAG_JOB },
-  { "prettyprint-default",	IPP_TAG_BOOLEAN,	IPP_TAG_PRINTER },
-  { "print-quality",		IPP_TAG_ENUM,		IPP_TAG_JOB },
-  { "print-quality-default",	IPP_TAG_ENUM,		IPP_TAG_PRINTER },
-  { "printer-error-policy",	IPP_TAG_NAME,		IPP_TAG_PRINTER },
-  { "printer-info",		IPP_TAG_TEXT,		IPP_TAG_PRINTER },
-  { "printer-is-accepting-jobs",IPP_TAG_BOOLEAN,	IPP_TAG_PRINTER },
-  { "printer-is-shared",	IPP_TAG_BOOLEAN,	IPP_TAG_PRINTER },
-  { "printer-location",		IPP_TAG_TEXT,		IPP_TAG_PRINTER },
-  { "printer-make-and-model",	IPP_TAG_TEXT,		IPP_TAG_PRINTER },
-  { "printer-more-info",	IPP_TAG_URI,		IPP_TAG_PRINTER },
-  { "printer-op-policy",	IPP_TAG_NAME,		IPP_TAG_PRINTER },
-  { "printer-resolution",	IPP_TAG_RESOLUTION,	IPP_TAG_JOB },
-  { "printer-state",		IPP_TAG_ENUM,		IPP_TAG_PRINTER },
-  { "printer-state-change-time",IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
-  { "printer-state-reasons",	IPP_TAG_KEYWORD,	IPP_TAG_PRINTER },
-  { "printer-type",		IPP_TAG_ENUM,		IPP_TAG_PRINTER },
-  { "printer-uri",		IPP_TAG_URI,		IPP_TAG_OPERATION },
-  { "queued-job-count",		IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
-  { "raw",			IPP_TAG_MIMETYPE,	IPP_TAG_OPERATION },
-  { "requesting-user-name-allowed",	IPP_TAG_NAME,	IPP_TAG_PRINTER },
-  { "requesting-user-name-denied",	IPP_TAG_NAME,	IPP_TAG_PRINTER },
-  { "resolution",		IPP_TAG_RESOLUTION,	IPP_TAG_JOB },
-  { "resolution-default",	IPP_TAG_RESOLUTION,	IPP_TAG_PRINTER },
-  { "saturation",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
-  { "saturation-default",	IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
-  { "scaling",			IPP_TAG_INTEGER,	IPP_TAG_JOB },
-  { "scaling-default",		IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
-  { "sides",			IPP_TAG_KEYWORD,	IPP_TAG_JOB },
-  { "sides-default",		IPP_TAG_KEYWORD,	IPP_TAG_PRINTER },
-  { "wrap",			IPP_TAG_BOOLEAN,	IPP_TAG_JOB },
-  { "wrap-default",		IPP_TAG_BOOLEAN,	IPP_TAG_PRINTER }
+  { 1, "auth-info",		IPP_TAG_TEXT,		IPP_TAG_JOB },
+  { 1, "auth-info-required",	IPP_TAG_KEYWORD,	IPP_TAG_PRINTER },
+  { 0, "blackplot",		IPP_TAG_BOOLEAN,	IPP_TAG_JOB },
+  { 0, "blackplot-default",	IPP_TAG_BOOLEAN,	IPP_TAG_PRINTER },
+  { 0, "brightness",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
+  { 0, "brightness-default",	IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
+  { 0, "columns",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
+  { 0, "columns-default",	IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
+  { 0, "copies",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
+  { 0, "copies-default",	IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
+  { 0, "document-format",	IPP_TAG_MIMETYPE,	IPP_TAG_OPERATION },
+  { 0, "document-format-default", IPP_TAG_MIMETYPE,	IPP_TAG_PRINTER },
+  { 1, "finishings",		IPP_TAG_ENUM,		IPP_TAG_JOB },
+  { 1, "finishings-default",	IPP_TAG_ENUM,		IPP_TAG_PRINTER },
+  { 0, "fitplot",		IPP_TAG_BOOLEAN,	IPP_TAG_JOB },
+  { 0, "fitplot-default",	IPP_TAG_BOOLEAN,	IPP_TAG_PRINTER },
+  { 0, "gamma",			IPP_TAG_INTEGER,	IPP_TAG_JOB },
+  { 0, "gamma-default",		IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
+  { 0, "hue",			IPP_TAG_INTEGER,	IPP_TAG_JOB },
+  { 0, "hue-default",		IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
+  { 0, "job-k-limit",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
+  { 0, "job-page-limit",	IPP_TAG_INTEGER,	IPP_TAG_JOB },
+  { 0, "job-priority",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
+  { 0, "job-quota-period",	IPP_TAG_INTEGER,	IPP_TAG_JOB },
+  { 0, "job-uuid",		IPP_TAG_URI,		IPP_TAG_JOB },
+  { 0, "landscape",		IPP_TAG_BOOLEAN,	IPP_TAG_JOB },
+  { 1, "media",			IPP_TAG_KEYWORD,	IPP_TAG_JOB },
+  { 0, "mirror",		IPP_TAG_BOOLEAN,	IPP_TAG_JOB },
+  { 0, "mirror-default",	IPP_TAG_BOOLEAN,	IPP_TAG_PRINTER },
+  { 0, "natural-scaling",	IPP_TAG_INTEGER,	IPP_TAG_JOB },
+  { 0, "natural-scaling-default", IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
+  { 0, "notify-charset",	IPP_TAG_CHARSET,	IPP_TAG_SUBSCRIPTION },
+  { 1, "notify-events",		IPP_TAG_KEYWORD,	IPP_TAG_SUBSCRIPTION },
+  { 1, "notify-events-default",	IPP_TAG_KEYWORD,	IPP_TAG_PRINTER },
+  { 0, "notify-lease-duration",	IPP_TAG_INTEGER,	IPP_TAG_SUBSCRIPTION },
+  { 0, "notify-lease-duration-default", IPP_TAG_INTEGER, IPP_TAG_PRINTER },
+  { 0, "notify-natural-language", IPP_TAG_LANGUAGE,	IPP_TAG_SUBSCRIPTION },
+  { 0, "notify-pull-method",	IPP_TAG_KEYWORD,	IPP_TAG_SUBSCRIPTION },
+  { 0, "notify-recipient-uri",	IPP_TAG_URI,		IPP_TAG_SUBSCRIPTION },
+  { 0, "notify-time-interval",	IPP_TAG_INTEGER,	IPP_TAG_SUBSCRIPTION },
+  { 0, "notify-user-data",	IPP_TAG_STRING,		IPP_TAG_SUBSCRIPTION },
+  { 0, "number-up",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
+  { 0, "number-up-default",	IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
+  { 0, "orientation-requested",	IPP_TAG_ENUM,		IPP_TAG_JOB },
+  { 0, "orientation-requested-default", IPP_TAG_ENUM,	IPP_TAG_PRINTER },
+  { 0, "page-bottom",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
+  { 0, "page-bottom-default",	IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
+  { 0, "page-left",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
+  { 0, "page-left-default",	IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
+  { 1, "page-ranges",		IPP_TAG_RANGE,		IPP_TAG_JOB },
+  { 1, "page-ranges-default",	IPP_TAG_RANGE,		IPP_TAG_PRINTER },
+  { 0, "page-right",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
+  { 0, "page-right-default",	IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
+  { 0, "page-top",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
+  { 0, "page-top-default",	IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
+  { 0, "penwidth",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
+  { 0, "penwidth-default",	IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
+  { 0, "port-monitor",		IPP_TAG_NAME,		IPP_TAG_PRINTER },
+  { 0, "ppi",			IPP_TAG_INTEGER,	IPP_TAG_JOB },
+  { 0, "ppi-default",		IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
+  { 0, "prettyprint",		IPP_TAG_BOOLEAN,	IPP_TAG_JOB },
+  { 0, "prettyprint-default",	IPP_TAG_BOOLEAN,	IPP_TAG_PRINTER },
+  { 0, "print-quality",		IPP_TAG_ENUM,		IPP_TAG_JOB },
+  { 0, "print-quality-default",	IPP_TAG_ENUM,		IPP_TAG_PRINTER },
+  { 0, "printer-error-policy",	IPP_TAG_NAME,		IPP_TAG_PRINTER },
+  { 0, "printer-info",		IPP_TAG_TEXT,		IPP_TAG_PRINTER },
+  { 0, "printer-is-accepting-jobs", IPP_TAG_BOOLEAN,	IPP_TAG_PRINTER },
+  { 0, "printer-is-shared",	IPP_TAG_BOOLEAN,	IPP_TAG_PRINTER },
+  { 0, "printer-location",	IPP_TAG_TEXT,		IPP_TAG_PRINTER },
+  { 0, "printer-make-and-model", IPP_TAG_TEXT,		IPP_TAG_PRINTER },
+  { 0, "printer-more-info",	IPP_TAG_URI,		IPP_TAG_PRINTER },
+  { 0, "printer-op-policy",	IPP_TAG_NAME,		IPP_TAG_PRINTER },
+  { 0, "printer-resolution",	IPP_TAG_RESOLUTION,	IPP_TAG_JOB },
+  { 0, "printer-state",		IPP_TAG_ENUM,		IPP_TAG_PRINTER },
+  { 0, "printer-state-change-time", IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
+  { 1, "printer-state-reasons",	IPP_TAG_KEYWORD,	IPP_TAG_PRINTER },
+  { 0, "printer-type",		IPP_TAG_ENUM,		IPP_TAG_PRINTER },
+  { 0, "printer-uri",		IPP_TAG_URI,		IPP_TAG_OPERATION },
+  { 0, "queued-job-count",	IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
+  { 0, "raw",			IPP_TAG_MIMETYPE,	IPP_TAG_OPERATION },
+  { 1, "requesting-user-name-allowed", IPP_TAG_NAME,	IPP_TAG_PRINTER },
+  { 1, "requesting-user-name-denied", IPP_TAG_NAME,	IPP_TAG_PRINTER },
+  { 0, "resolution",		IPP_TAG_RESOLUTION,	IPP_TAG_JOB },
+  { 0, "resolution-default",	IPP_TAG_RESOLUTION,	IPP_TAG_PRINTER },
+  { 0, "saturation",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
+  { 0, "saturation-default",	IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
+  { 0, "scaling",		IPP_TAG_INTEGER,	IPP_TAG_JOB },
+  { 0, "scaling-default",	IPP_TAG_INTEGER,	IPP_TAG_PRINTER },
+  { 0, "sides",			IPP_TAG_KEYWORD,	IPP_TAG_JOB },
+  { 0, "sides-default",		IPP_TAG_KEYWORD,	IPP_TAG_PRINTER },
+  { 0, "wrap",			IPP_TAG_BOOLEAN,	IPP_TAG_JOB },
+  { 0, "wrap-default",		IPP_TAG_BOOLEAN,	IPP_TAG_PRINTER }
 };
 
 
@@ -192,7 +192,8 @@ cupsEncodeOptions2(
   char		*s,			/* Pointer into option value */
 		*val,			/* Pointer to option value */
 		*copy,			/* Copy of option value */
-		*sep;			/* Option separator */
+		*sep,			/* Option separator */
+		quote;			/* Quote character */
   ipp_attribute_t *attr;		/* IPP attribute */
   ipp_tag_t	value_tag;		/* IPP value tag */
   cups_option_t	*option;		/* Current option */
@@ -284,41 +285,28 @@ cupsEncodeOptions2(
     * Count the number of values...
     */
 
-    for (count = 1, sep = option->value; *sep; sep ++)
+    if (match && match->multivalue)
     {
-      if (*sep == '\'')
+      for (count = 1, sep = option->value, quote = 0; *sep; sep ++)
       {
-       /*
-        * Skip quoted option value...
-	*/
-
-        sep ++;
-
-        while (*sep && *sep != '\'')
-	  sep ++;
-
-	if (!*sep)
-	  sep --;
-      }
-      else if (*sep == '\"')
-      {
-       /*
-        * Skip quoted option value...
-	*/
-
-        sep ++;
-
-        while (*sep && *sep != '\"')
+	if (*sep == quote)
+	  quote = 0;
+	else if (!quote && (*sep == '\'' || *sep == '\"'))
+	{
+	 /*
+	  * Skip quoted option value...
+	  */
+
+	  quote = *sep++;
+	}
+	else if (*sep == ',' && !quote)
+	  count ++;
+	else if (*sep == '\\' && sep[1])
 	  sep ++;
-
-	if (!*sep)
-	  sep --;
       }
-      else if (*sep == ',')
-        count ++;
-      else if (*sep == '\\' && sep[1])
-        sep ++;
     }
+    else
+      count = 1;
 
     DEBUG_printf(("cupsEncodeOptions2: option = \'%s\', count = %d\n",
                   option->name, count));
@@ -390,16 +378,47 @@ cupsEncodeOptions2(
     * Scan the value string for values...
     */
 
-    for (j = 0; j < count; val = sep, j ++)
+    for (j = 0, sep = val; j < count; val = sep, j ++)
     {
      /*
       * Find the end of this value and mark it if needed...
       */
 
-      if ((sep = strchr(val, ',')) != NULL)
-	*sep++ = '\0';
-      else
-	sep = val + strlen(val);
+      if (count > 1)
+      {
+	for (quote = 0; *sep; sep ++)
+	{
+	  if (*sep == quote)
+	  {
+	   /*
+	    * Finish quoted value...
+	    */
+
+	    quote = 0;
+	  }
+	  else if (!quote && (*sep == '\'' || *sep == '\"'))
+	  {
+	   /*
+	    * Handle quoted option value...
+	    */
+
+	    quote = *sep;
+	  }
+	  else if (*sep == ',' && count > 1)
+	    break;
+	  else if (*sep == '\\' && sep[1])
+	  {
+	   /*
+	    * Skip quoted character...
+	    */
+
+	    sep ++;
+	  }
+	}
+
+	if (*sep == ',')
+	  *sep++ = '\0';
+      }
 
      /*
       * Copy the option value(s) over as needed by the type...
@@ -413,7 +432,7 @@ cupsEncodeOptions2(
 	    * Integer/enumeration value...
 	    */
 
-            attr->values[j].integer = strtol(val, &s, 0);
+            attr->values[j].integer = strtol(val, &s, 10);
 
             DEBUG_printf(("cupsEncodeOptions2: Added integer option value %d...\n",
 	                  attr->values[j].integer));
@@ -455,12 +474,12 @@ cupsEncodeOptions2(
 	      s = val;
 	    }
 	    else
-	      attr->values[j].range.lower = strtol(val, &s, 0);
+	      attr->values[j].range.lower = strtol(val, &s, 10);
 
 	    if (*s == '-')
 	    {
 	      if (s[1])
-		attr->values[j].range.upper = strtol(s + 1, NULL, 0);
+		attr->values[j].range.upper = strtol(s + 1, NULL, 10);
 	      else
 		attr->values[j].range.upper = 2147483647;
             }
@@ -477,10 +496,10 @@ cupsEncodeOptions2(
 	    * Resolution...
 	    */
 
-	    attr->values[j].resolution.xres = strtol(val, &s, 0);
+	    attr->values[j].resolution.xres = strtol(val, &s, 10);
 
 	    if (*s == 'x')
-	      attr->values[j].resolution.yres = strtol(s + 1, &s, 0);
+	      attr->values[j].resolution.yres = strtol(s + 1, &s, 10);
 	    else
 	      attr->values[j].resolution.yres = attr->values[j].resolution.xres;
 
@@ -499,7 +518,7 @@ cupsEncodeOptions2(
 	    */
 
             attr->values[j].unknown.length = (int)strlen(val);
-	    attr->values[j].unknown.data   = _cupsStrAlloc(val);
+	    attr->values[j].unknown.data   = strdup(val);
 
             DEBUG_printf(("cupsEncodeOptions2: Added octet-string value \"%s\"...\n",
 	                  attr->values[j].unknown.data));
diff -up cups-1.3.5/notifier/Makefile.1.3.x cups-1.3.5/notifier/Makefile
--- cups-1.3.5/notifier/Makefile.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/notifier/Makefile	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
 #
 #   Notifier makefile for the Common UNIX Printing System (CUPS).
 #
-#   Copyright 2007 by Apple Inc.
+#   Copyright 2007-2008 by Apple Inc.
 #   Copyright 1997-2007 by Easy Software Products, all rights reserved.
 #
 #   These coded instructions, statements, and computer programs are the
@@ -44,7 +44,7 @@ install:	all
 	for file in $(TARGETS); do \
 		$(INSTALL_BIN) $$file $(SERVERBIN)/notifier; \
 	done
-	$(INSTALL_DIR) -m 755 $(CACHEDIR)/rss
+	$(INSTALL_DIR) -m 775 $(CACHEDIR)/rss
 	-chgrp $(CUPS_GROUP) $(CACHEDIR)/rss
 	if test "x$(SYMROOT)" != "x"; then \
 		$(INSTALL_DIR) $(SYMROOT); \
diff -up cups-1.3.5/pdftops/pdftops.cxx.1.3.x cups-1.3.5/pdftops/pdftops.cxx
--- cups-1.3.5/pdftops/pdftops.cxx.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/pdftops/pdftops.cxx	2008-02-14 13:03:30.000000000 +0000
@@ -308,8 +308,7 @@ main(int  argc,				// I - Number of comm
     // write PostScript file
     psOut = new PSOutputDev(psFileName->getCString(), doc->getXRef(),
                             doc->getCatalog(), 1, doc->getNumPages(),
-			    psModePS, 0, 0, 0, 0, gFalse,
-			    cupsGetOption("page-ranges", num_options, options));
+			    psModePS, 0, 0, 0, 0, gFalse, NULL);
     if (psOut->isOk())
       doc->displayPages(psOut, 1, doc->getNumPages(), 72.0, 72.0, 0,
                         gTrue, gFalse, gFalse);
diff -up cups-1.3.5/scheduler/testspeed.c.1.3.x cups-1.3.5/scheduler/testspeed.c
--- cups-1.3.5/scheduler/testspeed.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/scheduler/testspeed.c	2008-02-14 13:03:30.000000000 +0000
@@ -166,7 +166,7 @@ main(int  argc,				/* I - Number of comm
   * Exit with no errors...
   */
 
-  return (status);
+  return (0);
 }
 
 
diff -up cups-1.3.5/scheduler/banners.c.1.3.x cups-1.3.5/scheduler/banners.c
--- cups-1.3.5/scheduler/banners.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/scheduler/banners.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Banner routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2006 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -147,8 +147,8 @@ add_banner(const char *name,		/* I - Nam
   if ((filetype = mimeFileType(MimeDatabase, filename, NULL, NULL)) == NULL)
   {
     cupsdLogMessage(CUPSD_LOG_WARN,
-                    "add_banner: Banner \"%s\" (\"%s\") is of an unknown file type - skipping!",
-                    name, filename);
+                    "add_banner: Banner \"%s\" (\"%s\") is of an unknown file "
+		    "type - skipping!", name, filename);
     return;
   }
 
@@ -156,13 +156,27 @@ add_banner(const char *name,		/* I - Nam
   * Allocate memory...
   */
 
-  temp = calloc(1, sizeof(cupsd_banner_t));
+  if ((temp = calloc(1, sizeof(cupsd_banner_t))) == NULL)
+  {
+    cupsdLogMessage(CUPSD_LOG_WARN,
+                    "add_banner: Unable to allocate memory for banner \"%s\" - "
+		    "skipping!", name);
+    return;
+  }
 
  /*
   * Copy the new banner data over...
   */
 
-  temp->name     = strdup(name);
+  if ((temp->name = strdup(name)) == NULL)
+  {
+    cupsdLogMessage(CUPSD_LOG_WARN,
+                    "add_banner: Unable to allocate memory for banner \"%s\" - "
+		    "skipping!", name);
+    free(temp);
+    return;
+  }
+
   temp->filetype = filetype;
 
   cupsArrayAdd(Banners, temp);
diff -up cups-1.3.5/scheduler/printers.h.1.3.x cups-1.3.5/scheduler/printers.h
--- cups-1.3.5/scheduler/printers.h.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/scheduler/printers.h	2008-02-14 13:03:30.000000000 +0000
@@ -86,6 +86,7 @@ typedef struct cupsd_printer_s
   const char	*auth_info_required[4];	/* Required authentication fields */
   char		*alert,			/* PSX printer-alert value */
 		*alert_description;	/* PSX printer-alert-description value */
+  time_t	marker_time;		/* Last time marker attributes were updated */
 
 #ifdef __APPLE__
   char		*recoverable;		/* com.apple.print.recoverable-message */
@@ -150,6 +151,8 @@ extern void		cupsdSaveAllPrinters(void);
 extern int		cupsdSetAuthInfoRequired(cupsd_printer_t *p,
 			                         const char *values,
 						 ipp_attribute_t *attr);
+extern void		cupsdSetPrinterAttr(cupsd_printer_t *p,
+			                    const char *name, char *value);
 extern void		cupsdSetPrinterAttrs(cupsd_printer_t *p);
 extern void		cupsdSetPrinterReasons(cupsd_printer_t *p,
 			                       const char *s);
diff -up cups-1.3.5/scheduler/cupsfilter.c.1.3.x cups-1.3.5/scheduler/cupsfilter.c
--- cups-1.3.5/scheduler/cupsfilter.c.1.3.x	2007-08-20 21:16:00.000000000 +0100
+++ cups-1.3.5/scheduler/cupsfilter.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   CUPS filtering program for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2006 by Easy Software Products, all rights reserved.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -131,6 +131,7 @@ main(int  argc,				/* I - Number of comm
 
   mime         = NULL;
   srctype      = NULL;
+  compression  = 0;
   dsttype      = "application/pdf";
   infile       = NULL;
   outfile      = NULL;
@@ -456,7 +457,8 @@ escape_options(
   for (i = num_options, option = options, bytes = 1; i > 0; i --, option ++)
     bytes += 2 * (strlen(option->name) + strlen(option->value)) + 2;
 
-  s = malloc(bytes);
+  if ((s = malloc(bytes)) == NULL)
+    return (NULL);
 
  /*
   * Copy the options to the string...
@@ -806,6 +808,8 @@ exec_filters(cups_array_t  *filters,	/* 
     }
   }
 
+  cupsArrayDelete(pids);
+
   return (retval);
 }
 
diff -up cups-1.3.5/scheduler/main.c.1.3.x cups-1.3.5/scheduler/main.c
--- cups-1.3.5/scheduler/main.c.1.3.x	2007-11-09 19:54:09.000000000 +0000
+++ cups-1.3.5/scheduler/main.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Scheduler main loop for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -133,10 +133,7 @@ main(int  argc,				/* I - Number of comm
 			browse_time,	/* Next browse send time */
 			senddoc_time,	/* Send-Document time */
 			expire_time,	/* Subscription expire time */
-			mallinfo_time;	/* Malloc information time */
-  size_t		string_count,	/* String count */
-			alloc_bytes,	/* Allocated string bytes */
-			total_bytes;	/* Total string bytes */
+			report_time;	/* Malloc/client/job report time */
   long			timeout;	/* Timeout for cupsdDoSelect() */
   struct rlimit		limit;		/* Runtime limit */
 #if defined(HAVE_SIGACTION) && !defined(HAVE_SIGSET)
@@ -149,6 +146,8 @@ main(int  argc,				/* I - Number of comm
 #ifdef __APPLE__
   int			run_as_child = 0;
 					/* Needed for Mac OS X fork/exec */
+#else
+  time_t		netif_time = 0;	/* Time since last network update */
 #endif /* __APPLE__ */
 #if HAVE_LAUNCHD
   int			launchd_idle_exit;
@@ -226,11 +225,22 @@ main(int  argc,				/* I - Number of comm
 		* are passed a NULL pointer.
 	        */
 
-                current = malloc(1024);
-		getcwd(current, 1024);
+                if ((current = malloc(1024)) == NULL)
+		{
+		  _cupsLangPuts(stderr,
+		                _("cupsd: Unable to get current directory!\n"));
+                  return (1);
+		}
+
+		if (!getcwd(current, 1024))
+		{
+		  _cupsLangPuts(stderr,
+		                _("cupsd: Unable to get current directory!\n"));
+                  free(current);
+		  return (1);
+		}
 
 		cupsdSetStringf(&ConfigurationFile, "%s/%s", current, argv[i]);
-
 		free(current);
               }
 	      break;
@@ -632,11 +642,11 @@ main(int  argc,				/* I - Number of comm
   * Loop forever...
   */
 
-  mallinfo_time = 0;
   browse_time   = time(NULL);
-  senddoc_time  = time(NULL);
   expire_time   = time(NULL);
   fds           = 1;
+  report_time   = 0;
+  senddoc_time  = time(NULL);
 
   while (!stop_scheduler)
   {
@@ -827,6 +837,18 @@ main(int  argc,				/* I - Number of comm
 
     current_time = time(NULL);
 
+#ifndef __APPLE__
+   /*
+    * Update the network interfaces once a minute...
+    */
+
+    if ((current_time - netif_time) >= 60)
+    {
+      netif_time  = current_time;
+      NetIFUpdate = 1;
+    }
+#endif /* !__APPLE__ */
+
 #if HAVE_LAUNCHD
    /*
     * If no other work was scheduled and we're being controlled by launchd
@@ -903,7 +925,7 @@ main(int  argc,				/* I - Number of comm
       */
 
       cupsdDeleteCert(0);
-      cupsdAddCert(0, "root");
+      cupsdAddCert(0, "root", NULL);
     }
 
    /*
@@ -951,30 +973,49 @@ main(int  argc,				/* I - Number of comm
     }
 
    /*
-    * Log memory usage every minute...
+    * Log statistics at most once a minute when in debug mode...
     */
 
-    if ((current_time - mallinfo_time) >= 60 && LogLevel >= CUPSD_LOG_DEBUG2)
+    if ((current_time - report_time) >= 60 && LogLevel >= CUPSD_LOG_DEBUG)
     {
+      size_t		string_count,	/* String count */
+			alloc_bytes,	/* Allocated string bytes */
+			total_bytes;	/* Total string bytes */
 #ifdef HAVE_MALLINFO
-      struct mallinfo mem;		/* Malloc information */
+      struct mallinfo	mem;		/* Malloc information */
 
 
       mem = mallinfo();
-      cupsdLogMessage(CUPSD_LOG_DEBUG2,
-                      "mallinfo: arena = %d, used = %d, free = %d\n",
-                      mem.arena, mem.usmblks + mem.uordblks,
+      cupsdLogMessage(CUPSD_LOG_DEBUG, "Report: malloc-arena=%lu", mem.arena);
+      cupsdLogMessage(CUPSD_LOG_DEBUG, "Report: malloc-used=%lu",
+                      mem.usmblks + mem.uordblks);
+      cupsdLogMessage(CUPSD_LOG_DEBUG, "Report: malloc-free=%lu",
 		      mem.fsmblks + mem.fordblks);
 #endif /* HAVE_MALLINFO */
 
+      cupsdLogMessage(CUPSD_LOG_DEBUG, "Report: clients=%d",
+                      cupsArrayCount(Clients));
+      cupsdLogMessage(CUPSD_LOG_DEBUG, "Report: jobs=%d",
+                      cupsArrayCount(Jobs));
+      cupsdLogMessage(CUPSD_LOG_DEBUG, "Report: jobs-active=%d",
+                      cupsArrayCount(ActiveJobs));
+      cupsdLogMessage(CUPSD_LOG_DEBUG, "Report: printers=%d",
+                      cupsArrayCount(Printers));
+      cupsdLogMessage(CUPSD_LOG_DEBUG, "Report: printers-implicit=%d",
+                      cupsArrayCount(ImplicitPrinters));
+
       string_count = _cupsStrStatistics(&alloc_bytes, &total_bytes);
-      cupsdLogMessage(CUPSD_LOG_DEBUG2,
-                      "stringpool: " CUPS_LLFMT " strings, "
-		      CUPS_LLFMT " allocated, " CUPS_LLFMT " total bytes",
-		      CUPS_LLCAST string_count, CUPS_LLCAST alloc_bytes,
+      cupsdLogMessage(CUPSD_LOG_DEBUG,
+                      "Report: stringpool-string-count=" CUPS_LLFMT,
+		      CUPS_LLCAST string_count);
+      cupsdLogMessage(CUPSD_LOG_DEBUG,
+                      "Report: stringpool-alloc-bytes=" CUPS_LLFMT,
+		      CUPS_LLCAST alloc_bytes);
+      cupsdLogMessage(CUPSD_LOG_DEBUG,
+                      "Report: stringpool-total-bytes=" CUPS_LLFMT,
 		      CUPS_LLCAST total_bytes);
 
-      mallinfo_time = current_time;
+      report_time = current_time;
     }
 
    /*
@@ -1015,7 +1056,7 @@ main(int  argc,				/* I - Number of comm
       * Reset the accumulated events...
       */
 
-      LastEvent     = CUPSD_EVENT_NONE;
+      LastEvent = CUPSD_EVENT_NONE;
     }
   }
 
@@ -1622,8 +1663,11 @@ process_children(void)
 	    else
  	      job->status = -status;	/* Backend failed */
 
-            if (job->printer && !(job->printer->type & CUPS_PRINTER_FAX))
+            if (job->printer && !(job->printer->type & CUPS_PRINTER_FAX) &&
+	        job->status_level > CUPSD_LOG_ERROR)
 	    {
+	      job->status_level = CUPSD_LOG_ERROR;
+
               snprintf(job->printer->state_message,
 	               sizeof(job->printer->state_message), "%s failed", name);
               cupsdAddPrinterHistory(job->printer);
diff -up cups-1.3.5/scheduler/conf.c.1.3.x cups-1.3.5/scheduler/conf.c
--- cups-1.3.5/scheduler/conf.c.1.3.x	2007-11-09 19:54:09.000000000 +0000
+++ cups-1.3.5/scheduler/conf.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Configuration routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -384,7 +384,7 @@ cupsdReadConfiguration(void)
   if (NumRelays > 0)
   {
     for (i = 0; i < NumRelays; i ++)
-      if (Relays[i].from.type == AUTH_NAME)
+      if (Relays[i].from.type == CUPSD_AUTH_NAME)
 	free(Relays[i].from.mask.name.name);
 
     free(Relays);
@@ -508,7 +508,7 @@ cupsdReadConfiguration(void)
   */
 
   ConfigFilePerm        = CUPS_DEFAULT_CONFIG_FILE_PERM;
-  DefaultAuthType       = AUTH_BASIC;
+  DefaultAuthType       = CUPSD_AUTH_BASIC;
 #ifdef HAVE_SSL
   DefaultEncryption     = HTTP_ENCRYPT_REQUIRED;
 #endif /* HAVE_SSL */
@@ -962,8 +962,8 @@ cupsdReadConfiguration(void)
       cupsdLogMessage(CUPSD_LOG_INFO, "Order Deny,Allow");
 
       po = cupsdAddPolicyOp(p, NULL, IPP_SEND_DOCUMENT);
-      po->order_type = AUTH_ALLOW;
-      po->level      = AUTH_USER;
+      po->order_type = CUPSD_AUTH_ALLOW;
+      po->level      = CUPSD_AUTH_USER;
 
       cupsdAddName(po, "@OWNER");
       cupsdAddName(po, "@SYSTEM");
@@ -1003,9 +1003,9 @@ cupsdReadConfiguration(void)
       cupsdLogMessage(CUPSD_LOG_INFO, "AuthType Default");
 
       po = cupsdAddPolicyOp(p, NULL, IPP_PAUSE_PRINTER);
-      po->order_type = AUTH_ALLOW;
-      po->type       = AUTH_DEFAULT;
-      po->level      = AUTH_USER;
+      po->order_type = CUPSD_AUTH_ALLOW;
+      po->type       = CUPSD_AUTH_DEFAULT;
+      po->level      = CUPSD_AUTH_USER;
 
       cupsdAddName(po, "@SYSTEM");
       cupsdLogMessage(CUPSD_LOG_INFO, "Require user @SYSTEM");
@@ -1038,7 +1038,7 @@ cupsdReadConfiguration(void)
       cupsdLogMessage(CUPSD_LOG_INFO, "Order Deny,Allow");
 
       po = cupsdAddPolicyOp(p, NULL, IPP_ANY_OPERATION);
-      po->order_type = AUTH_ALLOW;
+      po->order_type = CUPSD_AUTH_ALLOW;
 
       cupsdLogMessage(CUPSD_LOG_INFO, "</Limit>");
       cupsdLogMessage(CUPSD_LOG_INFO, "</Policy>");
@@ -1119,19 +1119,27 @@ cupsdReadConfiguration(void)
     if (!mimeType(MimeDatabase, "application", "octet-stream"))
       NumMimeTypes ++;
 
-    MimeTypes = calloc(NumMimeTypes, sizeof(const char *));
-
-    for (i = 0, type = mimeFirstType(MimeDatabase);
-         type;
-	 i ++, type = mimeNextType(MimeDatabase))
+    if ((MimeTypes = calloc(NumMimeTypes, sizeof(const char *))) == NULL)
     {
-      snprintf(mimetype, sizeof(mimetype), "%s/%s", type->super, type->type);
-
-      MimeTypes[i] = _cupsStrAlloc(mimetype);
+      cupsdLogMessage(CUPSD_LOG_ERROR,
+                      "Unable to allocate memory for %d MIME types!",
+		      NumMimeTypes);
+      NumMimeTypes = 0;
     }
+    else
+    {
+      for (i = 0, type = mimeFirstType(MimeDatabase);
+	   type;
+	   i ++, type = mimeNextType(MimeDatabase))
+      {
+	snprintf(mimetype, sizeof(mimetype), "%s/%s", type->super, type->type);
+
+	MimeTypes[i] = _cupsStrAlloc(mimetype);
+      }
 
-    if (i < NumMimeTypes)
-      MimeTypes[i] = _cupsStrAlloc("application/octet-stream");
+      if (i < NumMimeTypes)
+	MimeTypes[i] = _cupsStrAlloc("application/octet-stream");
+    }
 
     if (LogLevel == CUPSD_LOG_DEBUG2)
     {
@@ -1568,9 +1576,9 @@ parse_aaa(cupsd_location_t *loc,	/* I - 
     */
 
     if (!strncasecmp(value, "deny", 4))
-      loc->order_type = AUTH_ALLOW;
+      loc->order_type = CUPSD_AUTH_ALLOW;
     else if (!strncasecmp(value, "allow", 5))
-      loc->order_type = AUTH_DENY;
+      loc->order_type = CUPSD_AUTH_DENY;
     else
     {
       cupsdLogMessage(CUPSD_LOG_ERROR, "Unknown Order value %s on line %d.",
@@ -1681,44 +1689,44 @@ parse_aaa(cupsd_location_t *loc,	/* I - 
 
     if (!strcasecmp(value, "none"))
     {
-      loc->type  = AUTH_NONE;
-      loc->level = AUTH_ANON;
+      loc->type  = CUPSD_AUTH_NONE;
+      loc->level = CUPSD_AUTH_ANON;
     }
     else if (!strcasecmp(value, "basic"))
     {
-      loc->type = AUTH_BASIC;
+      loc->type = CUPSD_AUTH_BASIC;
 
-      if (loc->level == AUTH_ANON)
-	loc->level = AUTH_USER;
+      if (loc->level == CUPSD_AUTH_ANON)
+	loc->level = CUPSD_AUTH_USER;
     }
     else if (!strcasecmp(value, "digest"))
     {
-      loc->type = AUTH_DIGEST;
+      loc->type = CUPSD_AUTH_DIGEST;
 
-      if (loc->level == AUTH_ANON)
-	loc->level = AUTH_USER;
+      if (loc->level == CUPSD_AUTH_ANON)
+	loc->level = CUPSD_AUTH_USER;
     }
     else if (!strcasecmp(value, "basicdigest"))
     {
-      loc->type = AUTH_BASICDIGEST;
+      loc->type = CUPSD_AUTH_BASICDIGEST;
 
-      if (loc->level == AUTH_ANON)
-	loc->level = AUTH_USER;
+      if (loc->level == CUPSD_AUTH_ANON)
+	loc->level = CUPSD_AUTH_USER;
     }
     else if (!strcasecmp(value, "default"))
     {
-      loc->type = AUTH_DEFAULT;
+      loc->type = CUPSD_AUTH_DEFAULT;
 
-      if (loc->level == AUTH_ANON)
-	loc->level = AUTH_USER;
+      if (loc->level == CUPSD_AUTH_ANON)
+	loc->level = CUPSD_AUTH_USER;
     }
 #ifdef HAVE_GSSAPI
     else if (!strcasecmp(value, "negotiate"))
     {
-      loc->type = AUTH_NEGOTIATE;
+      loc->type = CUPSD_AUTH_NEGOTIATE;
 
-      if (loc->level == AUTH_ANON)
-	loc->level = AUTH_USER;
+      if (loc->level == CUPSD_AUTH_ANON)
+	loc->level = CUPSD_AUTH_USER;
     }
 #endif /* HAVE_GSSAPI */
     else
@@ -1737,8 +1745,8 @@ parse_aaa(cupsd_location_t *loc,	/* I - 
 
     if (!strcasecmp(value, "anonymous"))
     {
-      loc->type  = AUTH_NONE;
-      loc->level = AUTH_ANON;
+      loc->type  = CUPSD_AUTH_NONE;
+      loc->level = CUPSD_AUTH_ANON;
 
       cupsdLogMessage(CUPSD_LOG_WARN,
                       "\"AuthClass %s\" is deprecated; consider removing "
@@ -1747,7 +1755,7 @@ parse_aaa(cupsd_location_t *loc,	/* I - 
     }
     else if (!strcasecmp(value, "user"))
     {
-      loc->level = AUTH_USER;
+      loc->level = CUPSD_AUTH_USER;
 
       cupsdLogMessage(CUPSD_LOG_WARN,
                       "\"AuthClass %s\" is deprecated; consider using "
@@ -1756,7 +1764,7 @@ parse_aaa(cupsd_location_t *loc,	/* I - 
     }
     else if (!strcasecmp(value, "group"))
     {
-      loc->level = AUTH_GROUP;
+      loc->level = CUPSD_AUTH_GROUP;
 
       cupsdLogMessage(CUPSD_LOG_WARN,
                       "\"AuthClass %s\" is deprecated; consider using "
@@ -1765,7 +1773,7 @@ parse_aaa(cupsd_location_t *loc,	/* I - 
     }
     else if (!strcasecmp(value, "system"))
     {
-      loc->level = AUTH_GROUP;
+      loc->level = CUPSD_AUTH_GROUP;
 
       cupsdAddName(loc, "@SYSTEM");
 
@@ -1810,9 +1818,9 @@ parse_aaa(cupsd_location_t *loc,	/* I - 
 
     if (!strcasecmp(value, "valid-user") ||
         !strcasecmp(value, "user"))
-      loc->level = AUTH_USER;
+      loc->level = CUPSD_AUTH_USER;
     else if (!strcasecmp(value, "group"))
-      loc->level = AUTH_GROUP;
+      loc->level = CUPSD_AUTH_GROUP;
     else
     {
       cupsdLogMessage(CUPSD_LOG_WARN, "Unknown Require type %s on line %d.",
@@ -1873,9 +1881,9 @@ parse_aaa(cupsd_location_t *loc,	/* I - 
   else if (!strcasecmp(line, "Satisfy"))
   {
     if (!strcasecmp(value, "all"))
-      loc->satisfy = AUTH_SATISFY_ALL;
+      loc->satisfy = CUPSD_AUTH_SATISFY_ALL;
     else if (!strcasecmp(value, "any"))
-      loc->satisfy = AUTH_SATISFY_ANY;
+      loc->satisfy = CUPSD_AUTH_SATISFY_ANY;
     else
     {
       cupsdLogMessage(CUPSD_LOG_WARN, "Unknown Satisfy value %s on line %d.",
@@ -2353,9 +2361,9 @@ read_configuration(cups_file_t *fp)	/* I
         cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Unable to initialize browse access control list!");
       else if (!strncasecmp(value, "deny", 4))
-        location->order_type = AUTH_ALLOW;
+        location->order_type = CUPSD_AUTH_ALLOW;
       else if (!strncasecmp(value, "allow", 5))
-        location->order_type = AUTH_DENY;
+        location->order_type = CUPSD_AUTH_DENY;
       else
         cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Unknown BrowseOrder value %s on line %d.",
@@ -2559,8 +2567,16 @@ read_configuration(cups_file_t *fp)	/* I
 	if ((ptr = strchr(temp, ' ')) != NULL)
 	  *ptr = '\0';
 
-        relay->from.type             = AUTH_NAME;
-	relay->from.mask.name.name   = strdup(temp);
+        relay->from.type = CUPSD_AUTH_NAME;
+
+	if ((relay->from.mask.name.name = strdup(temp)) == NULL)
+	{
+	  cupsdLogMessage(CUPSD_LOG_ERROR,
+			  "Unable to allocate BrowseRelay name at line %d - %s.",
+			  linenum, strerror(errno));
+	  continue;
+	}
+
 	relay->from.mask.name.length = strlen(temp);
       }
       else
@@ -2576,7 +2592,7 @@ read_configuration(cups_file_t *fp)	/* I
 	  break;
 	}
 
-        relay->from.type = AUTH_IP;
+        relay->from.type = CUPSD_AUTH_IP;
 	memcpy(relay->from.mask.ip.address, ip,
 	       sizeof(relay->from.mask.ip.address));
 	memcpy(relay->from.mask.ip.netmask, mask,
@@ -2626,7 +2642,7 @@ read_configuration(cups_file_t *fp)	/* I
   
 	  httpAddrString(&(relay->to), temp, sizeof(temp));
   
-	  if (relay->from.type == AUTH_IP)
+	  if (relay->from.type == CUPSD_AUTH_IP)
 	    snprintf(temp2, sizeof(temp2), "%u.%u.%u.%u/%u.%u.%u.%u",
 		     relay->from.mask.ip.address[0] >> 24,
 		     (relay->from.mask.ip.address[0] >> 16) & 255,
@@ -2652,7 +2668,7 @@ read_configuration(cups_file_t *fp)	/* I
       }
       else
       {
-        if (relay->from.type == AUTH_NAME)
+        if (relay->from.type == CUPSD_AUTH_NAME)
 	  free(relay->from.mask.name.name);
 
         cupsdLogMessage(CUPSD_LOG_ERROR, "Bad relay address %s at line %d.",
@@ -2728,16 +2744,16 @@ read_configuration(cups_file_t *fp)	/* I
       */
 
       if (!strcasecmp(value, "none"))
-	DefaultAuthType = AUTH_NONE;
+	DefaultAuthType = CUPSD_AUTH_NONE;
       else if (!strcasecmp(value, "basic"))
-	DefaultAuthType = AUTH_BASIC;
+	DefaultAuthType = CUPSD_AUTH_BASIC;
       else if (!strcasecmp(value, "digest"))
-	DefaultAuthType = AUTH_DIGEST;
+	DefaultAuthType = CUPSD_AUTH_DIGEST;
       else if (!strcasecmp(value, "basicdigest"))
-	DefaultAuthType = AUTH_BASICDIGEST;
+	DefaultAuthType = CUPSD_AUTH_BASICDIGEST;
 #ifdef HAVE_GSSAPI
       else if (!strcasecmp(value, "negotiate"))
-        DefaultAuthType = AUTH_NEGOTIATE;
+        DefaultAuthType = CUPSD_AUTH_NEGOTIATE;
 #endif /* HAVE_GSSAPI */
       else
       {
@@ -3125,7 +3141,7 @@ read_location(cups_file_t *fp,		/* I - C
   if ((parent = cupsdAddLocation(location)) == NULL)
     return (0);
 
-  parent->limit = AUTH_LIMIT_ALL;
+  parent->limit = CUPSD_AUTH_LIMIT_ALL;
   loc           = parent;
 
   while (cupsFileGetConf(fp, line, sizeof(line), &value, &linenum))
@@ -3157,19 +3173,19 @@ read_location(cups_file_t *fp,		/* I - C
 	  *valptr++ = '\0';
 
         if (!strcmp(value, "ALL"))
-	  loc->limit = AUTH_LIMIT_ALL;
+	  loc->limit = CUPSD_AUTH_LIMIT_ALL;
 	else if (!strcmp(value, "GET"))
-	  loc->limit |= AUTH_LIMIT_GET;
+	  loc->limit |= CUPSD_AUTH_LIMIT_GET;
 	else if (!strcmp(value, "HEAD"))
-	  loc->limit |= AUTH_LIMIT_HEAD;
+	  loc->limit |= CUPSD_AUTH_LIMIT_HEAD;
 	else if (!strcmp(value, "OPTIONS"))
-	  loc->limit |= AUTH_LIMIT_OPTIONS;
+	  loc->limit |= CUPSD_AUTH_LIMIT_OPTIONS;
 	else if (!strcmp(value, "POST"))
-	  loc->limit |= AUTH_LIMIT_POST;
+	  loc->limit |= CUPSD_AUTH_LIMIT_POST;
 	else if (!strcmp(value, "PUT"))
-	  loc->limit |= AUTH_LIMIT_PUT;
+	  loc->limit |= CUPSD_AUTH_LIMIT_PUT;
 	else if (!strcmp(value, "TRACE"))
-	  loc->limit |= AUTH_LIMIT_TRACE;
+	  loc->limit |= CUPSD_AUTH_LIMIT_TRACE;
 	else
 	  cupsdLogMessage(CUPSD_LOG_WARN, "Unknown request type %s on line %d!",
 	                  value, linenum);
@@ -3178,11 +3194,12 @@ read_location(cups_file_t *fp,		/* I - C
       }
 
       if (!strcasecmp(line, "<LimitExcept"))
-        loc->limit = AUTH_LIMIT_ALL ^ loc->limit;
+        loc->limit = CUPSD_AUTH_LIMIT_ALL ^ loc->limit;
 
       parent->limit &= ~loc->limit;
     }
-    else if (!strcasecmp(line, "</Limit>"))
+    else if (!strcasecmp(line, "</Limit>") ||
+             !strcasecmp(line, "</LimitExcept>"))
       loc = parent;
     else if (!parse_aaa(loc, line, value, linenum))
     {
diff -up cups-1.3.5/scheduler/auth.c.1.3.x cups-1.3.5/scheduler/auth.c
--- cups-1.3.5/scheduler/auth.c.1.3.x	2007-10-22 21:27:22.000000000 +0100
+++ cups-1.3.5/scheduler/auth.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Authorization routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  *   This file contains Kerberos support code, copyright 2006 by
@@ -176,8 +176,13 @@ cupsdAddLocation(const char *location)	/
   * Initialize the record and copy the name over...
   */
 
-  temp->location = strdup(location);
-  temp->length   = strlen(temp->location);
+  if ((temp->location = strdup(location)) == NULL)
+  {
+    free(temp);
+    return (NULL);
+  }
+
+  temp->length = strlen(temp->location);
 
   cupsArrayAdd(Locations, temp);
 
@@ -257,7 +262,7 @@ cupsdAllowHost(cupsd_location_t *loc,	/*
     * Allow *interface*...
     */
 
-    temp->type             = AUTH_INTERFACE;
+    temp->type             = CUPSD_AUTH_INTERFACE;
     temp->mask.name.name   = strdup("*");
     temp->mask.name.length = 1;
   }
@@ -277,7 +282,7 @@ cupsdAllowHost(cupsd_location_t *loc,	/*
       *ifptr = '\0';
     }
 
-    temp->type             = AUTH_INTERFACE;
+    temp->type             = CUPSD_AUTH_INTERFACE;
     temp->mask.name.name   = strdup(ifname);
     temp->mask.name.length = ifptr - ifname;
   }
@@ -287,7 +292,7 @@ cupsdAllowHost(cupsd_location_t *loc,	/*
     * Allow name...
     */
 
-    temp->type             = AUTH_NAME;
+    temp->type             = CUPSD_AUTH_NAME;
     temp->mask.name.name   = strdup(name);
     temp->mask.name.length = strlen(name);
   }
@@ -316,7 +321,7 @@ cupsdAllowIP(cupsd_location_t *loc,	/* I
   if ((temp = add_allow(loc)) == NULL)
     return;
 
-  temp->type = AUTH_IP;
+  temp->type = CUPSD_AUTH_IP;
   memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
   memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
 }
@@ -363,15 +368,15 @@ cupsdAuthorize(cupsd_client_t *con)	/* I
   */
 
   con->best = cupsdFindBest(con->uri, con->http.state);
-  con->type = AUTH_NONE;
+  con->type = CUPSD_AUTH_NONE;
 
   cupsdLogMessage(CUPSD_LOG_DEBUG2,
                   "cupsdAuthorize: con->uri=\"%s\", con->best=%p(%s)",
                   con->uri, con->best, con->best ? con->best->location : "");
 
-  if (con->best && con->best->type != AUTH_NONE)
+  if (con->best && con->best->type != CUPSD_AUTH_NONE)
   {
-    if (con->best->type == AUTH_DEFAULT)
+    if (con->best->type == CUPSD_AUTH_DEFAULT)
       type = DefaultAuthType;
     else
       type = con->best->type;
@@ -463,7 +468,7 @@ cupsdAuthorize(cupsd_client_t *con)	/* I
 
     AuthorizationFreeItemSet(authinfo);
 
-    con->type = AUTH_BASIC;
+    con->type = CUPSD_AUTH_BASIC;
   }
 #endif /* HAVE_AUTHORIZATION_H */
 #if defined(SO_PEERCRED) && defined(AF_LOCAL)
@@ -520,7 +525,7 @@ cupsdAuthorize(cupsd_client_t *con)	/* I
                     "cupsdAuthorize: Authorized as %s using PeerCred",
 		    username);
 
-    con->type = AUTH_BASIC;
+    con->type = CUPSD_AUTH_BASIC;
   }
 #endif /* SO_PEERCRED && AF_LOCAL */
   else if (!strncmp(authorization, "Local", 5) &&
@@ -550,7 +555,7 @@ cupsdAuthorize(cupsd_client_t *con)	/* I
       return;
     }
 
-    con->type = AUTH_BASIC;
+    con->type = CUPSD_AUTH_BASIC;
   }
   else if (!strncmp(authorization, "Basic", 5))
   {
@@ -612,7 +617,7 @@ cupsdAuthorize(cupsd_client_t *con)	/* I
     switch (type)
     {
       default :
-      case AUTH_BASIC :
+      case CUPSD_AUTH_BASIC :
           {
 #if HAVE_LIBPAM
 	   /*
@@ -811,7 +816,7 @@ cupsdAuthorize(cupsd_client_t *con)	/* I
 			  username);
           break;
 
-      case AUTH_BASICDIGEST :
+      case CUPSD_AUTH_BASICDIGEST :
          /*
 	  * Do Basic authentication with the Digest password file...
 	  */
@@ -915,7 +920,7 @@ cupsdAuthorize(cupsd_client_t *con)	/* I
                     "cupsdAuthorize: Authorized as %s using Digest",
 		    username);
 
-    con->type = AUTH_DIGEST;
+    con->type = CUPSD_AUTH_DIGEST;
   }
 #ifdef HAVE_GSSAPI
   else if (!strncmp(authorization, "Negotiate", 9)) 
@@ -1056,7 +1061,7 @@ cupsdAuthorize(cupsd_client_t *con)	/* I
 
       con->gss_have_creds = 1;
 
-      con->type = AUTH_NEGOTIATE;
+      con->type = CUPSD_AUTH_NEGOTIATE;
     }
     else
       gss_release_name(&minor_status, &client_name);
@@ -1109,7 +1114,7 @@ cupsdCheckAuth(
   {
     switch (masks->type)
     {
-      case AUTH_INTERFACE :
+      case CUPSD_AUTH_INTERFACE :
          /*
 	  * Check for a match with a network interface...
 	  */
@@ -1217,7 +1222,7 @@ cupsdCheckAuth(
 	  }
 	  break;
 
-      case AUTH_NAME :
+      case CUPSD_AUTH_NAME :
          /*
 	  * Check for exact name match...
 	  */
@@ -1236,7 +1241,7 @@ cupsdCheckAuth(
 	    return (1);
           break;
 
-      case AUTH_IP :
+      case CUPSD_AUTH_IP :
          /*
 	  * Check for IP/network address match...
 	  */
@@ -1427,7 +1432,7 @@ cupsdCopyLocation(
     for (i = 0; i < temp->num_allow; i ++)
       switch (temp->allow[i].type = (*loc)->allow[i].type)
       {
-        case AUTH_NAME :
+        case CUPSD_AUTH_NAME :
 	    temp->allow[i].mask.name.length = (*loc)->allow[i].mask.name.length;
 	    temp->allow[i].mask.name.name   = strdup((*loc)->allow[i].mask.name.name);
 
@@ -1440,7 +1445,7 @@ cupsdCopyLocation(
 	      return (NULL);
 	    }
 	    break;
-	case AUTH_IP :
+	case CUPSD_AUTH_IP :
 	    memcpy(&(temp->allow[i].mask.ip), &((*loc)->allow[i].mask.ip),
 	           sizeof(cupsd_ipmask_t));
 	    break;
@@ -1465,7 +1470,7 @@ cupsdCopyLocation(
     for (i = 0; i < temp->num_deny; i ++)
       switch (temp->deny[i].type = (*loc)->deny[i].type)
       {
-        case AUTH_NAME :
+        case CUPSD_AUTH_NAME :
 	    temp->deny[i].mask.name.length = (*loc)->deny[i].mask.name.length;
 	    temp->deny[i].mask.name.name   = strdup((*loc)->deny[i].mask.name.name);
 
@@ -1478,7 +1483,7 @@ cupsdCopyLocation(
 	      return (NULL);
 	    }
 	    break;
-	case AUTH_IP :
+	case CUPSD_AUTH_IP :
 	    memcpy(&(temp->deny[i].mask.ip), &((*loc)->deny[i].mask.ip),
 	           sizeof(cupsd_ipmask_t));
 	    break;
@@ -1538,14 +1543,14 @@ cupsdDeleteLocation(
     free(loc->names);
 
   for (i = loc->num_allow, mask = loc->allow; i > 0; i --, mask ++)
-    if (mask->type == AUTH_NAME || mask->type == AUTH_INTERFACE)
+    if (mask->type == CUPSD_AUTH_NAME || mask->type == CUPSD_AUTH_INTERFACE)
       free(mask->mask.name.name);
 
   if (loc->num_allow > 0)
     free(loc->allow);
 
   for (i = loc->num_deny, mask = loc->deny; i > 0; i --, mask ++)
-    if (mask->type == AUTH_NAME || mask->type == AUTH_INTERFACE)
+    if (mask->type == CUPSD_AUTH_NAME || mask->type == CUPSD_AUTH_INTERFACE)
       free(mask->mask.name.name);
 
   if (loc->num_deny > 0)
@@ -1582,7 +1587,7 @@ cupsdDenyHost(cupsd_location_t *loc,	/* 
     * Deny *interface*...
     */
 
-    temp->type             = AUTH_INTERFACE;
+    temp->type             = CUPSD_AUTH_INTERFACE;
     temp->mask.name.name   = strdup("*");
     temp->mask.name.length = 1;
   }
@@ -1602,7 +1607,7 @@ cupsdDenyHost(cupsd_location_t *loc,	/* 
       *ifptr = '\0';
     }
 
-    temp->type             = AUTH_INTERFACE;
+    temp->type             = CUPSD_AUTH_INTERFACE;
     temp->mask.name.name   = strdup(ifname);
     temp->mask.name.length = ifptr - ifname;
   }
@@ -1612,7 +1617,7 @@ cupsdDenyHost(cupsd_location_t *loc,	/* 
     * Deny name...
     */
 
-    temp->type             = AUTH_NAME;
+    temp->type             = CUPSD_AUTH_NAME;
     temp->mask.name.name   = strdup(name);
     temp->mask.name.length = strlen(name);
   }
@@ -1641,7 +1646,7 @@ cupsdDenyIP(cupsd_location_t *loc,	/* I 
   if ((temp = add_deny(loc)) == NULL)
     return;
 
-  temp->type = AUTH_IP;
+  temp->type = CUPSD_AUTH_IP;
   memcpy(temp->mask.ip.address, address, sizeof(temp->mask.ip.address));
   memcpy(temp->mask.ip.netmask, netmask, sizeof(temp->mask.ip.netmask));
 }
@@ -1662,22 +1667,22 @@ cupsdFindBest(const char   *path,	/* I -
 			*best;		/* Best match for location so far */
   int			bestlen;	/* Length of best match */
   int			limit;		/* Limit field */
-  static const int	limits[] =	/* Map http_status_t to AUTH_LIMIT_xyz */
+  static const int	limits[] =	/* Map http_status_t to CUPSD_AUTH_LIMIT_xyz */
 		{
-		  AUTH_LIMIT_ALL,
-		  AUTH_LIMIT_OPTIONS,
-		  AUTH_LIMIT_GET,
-		  AUTH_LIMIT_GET,
-		  AUTH_LIMIT_HEAD,
-		  AUTH_LIMIT_POST,
-		  AUTH_LIMIT_POST,
-		  AUTH_LIMIT_POST,
-		  AUTH_LIMIT_PUT,
-		  AUTH_LIMIT_PUT,
-		  AUTH_LIMIT_DELETE,
-		  AUTH_LIMIT_TRACE,
-		  AUTH_LIMIT_ALL,
-		  AUTH_LIMIT_ALL
+		  CUPSD_AUTH_LIMIT_ALL,
+		  CUPSD_AUTH_LIMIT_OPTIONS,
+		  CUPSD_AUTH_LIMIT_GET,
+		  CUPSD_AUTH_LIMIT_GET,
+		  CUPSD_AUTH_LIMIT_HEAD,
+		  CUPSD_AUTH_LIMIT_POST,
+		  CUPSD_AUTH_LIMIT_POST,
+		  CUPSD_AUTH_LIMIT_POST,
+		  CUPSD_AUTH_LIMIT_PUT,
+		  CUPSD_AUTH_LIMIT_PUT,
+		  CUPSD_AUTH_LIMIT_DELETE,
+		  CUPSD_AUTH_LIMIT_TRACE,
+		  CUPSD_AUTH_LIMIT_ALL,
+		  CUPSD_AUTH_LIMIT_ALL
 		};
 
 
@@ -1837,16 +1842,16 @@ cupsdIsAuthorized(cupsd_client_t *con,	/
 
   best = con->best;
 
-  if ((type = best->type) == AUTH_DEFAULT)
+  if ((type = best->type) == CUPSD_AUTH_DEFAULT)
     type = DefaultAuthType;
 
   cupsdLogMessage(CUPSD_LOG_DEBUG2,
-                  "cupsdIsAuthorized: level=AUTH_%s, type=%s, "
-		  "satisfy=AUTH_SATISFY_%s, num_names=%d",
+                  "cupsdIsAuthorized: level=CUPSD_AUTH_%s, type=%s, "
+		  "satisfy=CUPSD_AUTH_SATISFY_%s, num_names=%d",
                   levels[best->level], types[type],
 	          best->satisfy ? "ANY" : "ALL", best->num_names);
 
-  if (best->limit == AUTH_LIMIT_IPP)
+  if (best->limit == CUPSD_AUTH_LIMIT_IPP)
     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: op=%x(%s)",
                     best->op, ippOpString(best->op));
 
@@ -1890,7 +1895,7 @@ cupsdIsAuthorized(cupsd_client_t *con,	/
     * Access from localhost (127.0.0.1 or ::1) is always allowed...
     */
 
-    auth = AUTH_ALLOW;
+    auth = CUPSD_AUTH_ALLOW;
   }
   else
   {
@@ -1901,39 +1906,39 @@ cupsdIsAuthorized(cupsd_client_t *con,	/
     switch (best->order_type)
     {
       default :
-	  auth = AUTH_DENY;	/* anti-compiler-warning-code */
+	  auth = CUPSD_AUTH_DENY;	/* anti-compiler-warning-code */
 	  break;
 
-      case AUTH_ALLOW : /* Order Deny,Allow */
-          auth = AUTH_ALLOW;
+      case CUPSD_AUTH_ALLOW : /* Order Deny,Allow */
+          auth = CUPSD_AUTH_ALLOW;
 
           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
 	          	best->num_deny, best->deny))
-	    auth = AUTH_DENY;
+	    auth = CUPSD_AUTH_DENY;
 
           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
 	        	best->num_allow, best->allow))
-	    auth = AUTH_ALLOW;
+	    auth = CUPSD_AUTH_ALLOW;
 	  break;
 
-      case AUTH_DENY : /* Order Allow,Deny */
-          auth = AUTH_DENY;
+      case CUPSD_AUTH_DENY : /* Order Allow,Deny */
+          auth = CUPSD_AUTH_DENY;
 
           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
 	        	best->num_allow, best->allow))
-	    auth = AUTH_ALLOW;
+	    auth = CUPSD_AUTH_ALLOW;
 
           if (cupsdCheckAuth(address, con->http.hostname, hostlen,
 	        	best->num_deny, best->deny))
-	    auth = AUTH_DENY;
+	    auth = CUPSD_AUTH_DENY;
 	  break;
     }
   }
 
-  cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=AUTH_%s...",
+  cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdIsAuthorized: auth=CUPSD_AUTH_%s...",
                   auth ? "DENY" : "ALLOW");
 
-  if (auth == AUTH_DENY && best->satisfy == AUTH_SATISFY_ALL)
+  if (auth == CUPSD_AUTH_DENY && best->satisfy == CUPSD_AUTH_SATISFY_ALL)
     return (HTTP_FORBIDDEN);
 
 #ifdef HAVE_SSL
@@ -1943,9 +1948,9 @@ cupsdIsAuthorized(cupsd_client_t *con,	/
 
   if ((best->encryption >= HTTP_ENCRYPT_REQUIRED && !con->http.tls &&
       strcasecmp(con->http.hostname, "localhost") &&
-      best->satisfy == AUTH_SATISFY_ALL) &&
-      !(type == AUTH_NEGOTIATE || 
-        (type == AUTH_NONE && DefaultAuthType == AUTH_NEGOTIATE)))
+      best->satisfy == CUPSD_AUTH_SATISFY_ALL) &&
+      !(type == CUPSD_AUTH_NEGOTIATE || 
+        (type == CUPSD_AUTH_NONE && DefaultAuthType == CUPSD_AUTH_NEGOTIATE)))
   {
     cupsdLogMessage(CUPSD_LOG_DEBUG,
                     "cupsdIsAuthorized: Need upgrade to TLS...");
@@ -1957,12 +1962,12 @@ cupsdIsAuthorized(cupsd_client_t *con,	/
   * Now see what access level is required...
   */
 
-  if (best->level == AUTH_ANON ||	/* Anonymous access - allow it */
-      (type == AUTH_NONE && best->num_names == 0))
+  if (best->level == CUPSD_AUTH_ANON ||	/* Anonymous access - allow it */
+      (type == CUPSD_AUTH_NONE && best->num_names == 0))
     return (HTTP_OK);
 
-  if (!con->username[0] && type == AUTH_NONE &&
-      best->limit == AUTH_LIMIT_IPP)
+  if (!con->username[0] && type == CUPSD_AUTH_NONE &&
+      best->limit == CUPSD_AUTH_LIMIT_IPP)
   {
    /*
     * Check for unauthenticated username...
@@ -1979,7 +1984,7 @@ cupsdIsAuthorized(cupsd_client_t *con,	/
                       attr->values[0].string.text);
       strlcpy(username, attr->values[0].string.text, sizeof(username));
     }
-    else if (best->satisfy == AUTH_SATISFY_ALL || auth == AUTH_DENY)
+    else if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
       return (HTTP_UNAUTHORIZED);	/* Non-anonymous needs user/pass */
     else
       return (HTTP_OK);			/* unless overridden with Satisfy */
@@ -1995,14 +2000,14 @@ cupsdIsAuthorized(cupsd_client_t *con,	/
     if (!con->username[0])
 #endif /* HAVE_AUTHORIZATION_H */
     {
-      if (best->satisfy == AUTH_SATISFY_ALL || auth == AUTH_DENY)
+      if (best->satisfy == CUPSD_AUTH_SATISFY_ALL || auth == CUPSD_AUTH_DENY)
 	return (HTTP_UNAUTHORIZED);	/* Non-anonymous needs user/pass */
       else
 	return (HTTP_OK);		/* unless overridden with Satisfy */
     }
 
-    if (con->type != type && type != AUTH_NONE &&
-        (con->type != AUTH_BASIC || type != AUTH_BASICDIGEST))
+    if (con->type != type && type != CUPSD_AUTH_NONE &&
+        (con->type != CUPSD_AUTH_BASIC || type != CUPSD_AUTH_BASICDIGEST))
     {
       cupsdLogMessage(CUPSD_LOG_ERROR, "Authorized using %s, expected %s!",
                       types[con->type], types[type]);
@@ -2050,7 +2055,7 @@ cupsdIsAuthorized(cupsd_client_t *con,	/
   else
     pw = NULL;
 
-  if (best->level == AUTH_USER)
+  if (best->level == CUPSD_AUTH_USER)
   {
    /*
     * If there are no names associated with this location, then
diff -up cups-1.3.5/scheduler/cert.c.1.3.x cups-1.3.5/scheduler/cert.c
--- cups-1.3.5/scheduler/cert.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/scheduler/cert.c	2008-02-14 13:03:30.000000000 +0000
@@ -4,7 +4,7 @@
  *   Authentication certificate routines for the Common UNIX
  *   Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2006 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -42,7 +42,8 @@
 
 void
 cupsdAddCert(int        pid,		/* I - Process ID */
-             const char *username)	/* I - Username */
+             const char *username,	/* I - Username */
+             void       *ccache)	/* I - Kerberos credentials or NULL */
 {
   int		i;			/* Looping var */
   cupsd_cert_t	*cert;			/* Current certificate */
@@ -244,6 +245,16 @@ cupsdAddCert(int        pid,		/* I - Pro
   close(fd);
 
  /*
+  * Add Kerberos credentials as needed...
+  */
+
+#ifdef HAVE_GSSAPI
+  cert->ccache = (krb5_ccache)ccache;
+#else
+  (void)ccache;
+#endif /* HAVE_GSSAPI */
+
+ /*
   * Insert the certificate at the front of the list...
   */
 
@@ -282,6 +293,15 @@ cupsdDeleteCert(int pid)		/* I - Process
       else
         prev->next = cert->next;
 
+#ifdef HAVE_GSSAPI
+     /*
+      * Release Kerberos credentials as needed...
+      */
+
+      if (cert->ccache)
+	krb5_cc_destroy(KerberosContext, cert->ccache);
+#endif /* HAVE_GSSAPI */
+
       free(cert);
 
      /*
@@ -412,7 +432,7 @@ cupsdInitCerts(void)
   */
 
   if (!RunUser)
-    cupsdAddCert(0, "root");
+    cupsdAddCert(0, "root", NULL);
 }
 
 
diff -up cups-1.3.5/scheduler/log.c.1.3.x cups-1.3.5/scheduler/log.c
--- cups-1.3.5/scheduler/log.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/scheduler/log.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Log file routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -261,6 +261,9 @@ cupsdLogMessage(int        level,	/* I -
 
   if (len >= linesize)
   {
+    char	*temp;			/* Temporary string pointer */
+
+
     len ++;
 
     if (len < 8192)
@@ -268,18 +271,12 @@ cupsdLogMessage(int        level,	/* I -
     else if (len > 65536)
       len = 65536;
 
-    line = realloc(line, len);
+    temp = realloc(line, len);
 
-    if (line)
-      linesize = len;
-    else
+    if (temp)
     {
-      cupsFilePrintf(ErrorFile,
-                     "ERROR: Unable to allocate memory for line - %s\n",
-                     strerror(errno));
-      cupsFileFlush(ErrorFile);
-
-      return (0);
+      line     = temp;
+      linesize = len;
     }
 
     va_start(ap, message);
@@ -355,7 +352,7 @@ cupsdLogPage(cupsd_job_t *job,		/* I - J
  /*
   * Print a page log entry of the form:
   *
-  *    printer job-id user [DD/MON/YYYY:HH:MM:SS +TTTT] page num-copies \
+  *    printer user job-id [DD/MON/YYYY:HH:MM:SS +TTTT] page num-copies \
   *        billing hostname
   */
 
diff -up cups-1.3.5/scheduler/cups-deviced.c.1.3.x cups-1.3.5/scheduler/cups-deviced.c
--- cups-1.3.5/scheduler/cups-deviced.c.1.3.x	2007-10-10 22:25:29.000000000 +0100
+++ cups-1.3.5/scheduler/cups-deviced.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Device scanning mini-daemon for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2006 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -291,6 +291,8 @@ main(int  argc,				/* I - Number of comm
 	  if (!dev)
 	  {
             cupsDirClose(dir);
+	    fclose(fp);
+            kill(pid, SIGTERM);
 	    return (1);
 	  }
 
diff -up cups-1.3.5/scheduler/cups-driverd.c.1.3.x cups-1.3.5/scheduler/cups-driverd.c
--- cups-1.3.5/scheduler/cups-driverd.c.1.3.x	2007-08-02 19:05:03.000000000 +0100
+++ cups-1.3.5/scheduler/cups-driverd.c	2008-02-14 13:03:30.000000000 +0000
@@ -7,7 +7,7 @@
  *   in CUPS_DATADIR/model and dynamically generated PPD files using
  *   the driver helper programs in CUPS_SERVERBIN/driver.
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -1664,6 +1664,7 @@ load_drivers(void)
           if (!ppd)
 	  {
             cupsDirClose(dir);
+	    pclose(fp);
 	    return (0);
 	  }
 
diff -up cups-1.3.5/scheduler/mime.c.1.3.x cups-1.3.5/scheduler/mime.c
--- cups-1.3.5/scheduler/mime.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/scheduler/mime.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   MIME database file routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2006 by Easy Software Products, all rights reserved.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -235,7 +235,10 @@ mimeMerge(mime_t     *mime,		/* I - MIME
   if (!mime)
     mime = mimeNew();
   if (!mime)
+  {
+    cupsDirClose(dir);
     return (NULL);
+  }
 
  /*
   * Read all the .types files...
diff -up cups-1.3.5/scheduler/job.h.1.3.x cups-1.3.5/scheduler/job.h
--- cups-1.3.5/scheduler/job.h.1.3.x	2007-08-01 20:02:47.000000000 +0100
+++ cups-1.3.5/scheduler/job.h	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Print job definitions for the Common UNIX Printing System (CUPS) scheduler.
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -122,7 +122,7 @@ extern void		cupsdSetJobHoldUntil(cupsd_
 extern void		cupsdSetJobPriority(cupsd_job_t *job, int priority);
 extern void		cupsdStopAllJobs(int force);
 extern void		cupsdStopJob(cupsd_job_t *job, int force);
-extern void		cupsdTimeoutJob(cupsd_job_t *job);
+extern int		cupsdTimeoutJob(cupsd_job_t *job);
 extern void		cupsdUnloadCompletedJobs(void);
 
 
diff -up cups-1.3.5/scheduler/cups-lpd.c.1.3.x cups-1.3.5/scheduler/cups-lpd.c
--- cups-1.3.5/scheduler/cups-lpd.c.1.3.x	2007-08-08 22:09:31.000000000 +0100
+++ cups-1.3.5/scheduler/cups-lpd.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Line Printer Daemon interface for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2006 by Easy Software Products, all rights reserved.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -1274,9 +1274,9 @@ recv_print_job(
 	  if (status)
 	    break;
 	}
-
-	fclose(fp);
       }
+
+      fclose(fp);
     }
   }
 
diff -up cups-1.3.5/scheduler/client.c.1.3.x cups-1.3.5/scheduler/client.c
--- cups-1.3.5/scheduler/client.c.1.3.x	2007-09-28 20:47:00.000000000 +0100
+++ cups-1.3.5/scheduler/client.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Client routines for the Common UNIX Printing System (CUPS) scheduler.
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  *   This file contains Kerberos support code, copyright 2006 by
@@ -144,9 +144,19 @@ cupsdAcceptClient(cupsd_listener_t *lis)
     Clients = cupsArrayNew(NULL, NULL);
 
   if (!Clients)
+  {
+    cupsdLogMessage(CUPSD_LOG_ERROR,
+                    "Unable to allocate memory for client array!");
+    cupsdPauseListening();
     return;
+  }
 
-  con = calloc(1, sizeof(cupsd_client_t));
+  if ((con = calloc(1, sizeof(cupsd_client_t))) == NULL)
+  {
+    cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to allocate memory for client!");
+    cupsdPauseListening();
+    return;
+  }
 
   con->http.activity = time(NULL);
   con->file          = -1;
@@ -843,7 +853,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	      cupsdLogMessage(CUPSD_LOG_ERROR,
 	                      "Bad request line \"%s\" from %s!", line,
 	                      con->http.hostname);
-	      cupsdSendError(con, HTTP_BAD_REQUEST, AUTH_NONE);
+	      cupsdSendError(con, HTTP_BAD_REQUEST, CUPSD_AUTH_NONE);
 	      cupsdCloseClient(con);
 	      return;
 	  case 2 :
@@ -855,7 +865,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 		cupsdLogMessage(CUPSD_LOG_ERROR,
 		                "Bad request line \"%s\" from %s!", line,
 	                        con->http.hostname);
-		cupsdSendError(con, HTTP_BAD_REQUEST, AUTH_NONE);
+		cupsdSendError(con, HTTP_BAD_REQUEST, CUPSD_AUTH_NONE);
 		cupsdCloseClient(con);
 		return;
 	      }
@@ -870,7 +880,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	      }
 	      else
 	      {
-	        cupsdSendError(con, HTTP_NOT_SUPPORTED, AUTH_NONE);
+	        cupsdSendError(con, HTTP_NOT_SUPPORTED, CUPSD_AUTH_NONE);
 		cupsdCloseClient(con);
 		return;
 	      }
@@ -916,7 +926,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 
 	    cupsdLogMessage(CUPSD_LOG_ERROR, "Bad URI \"%s\" in request!",
 	                    con->uri);
-	    cupsdSendError(con, HTTP_METHOD_NOT_ALLOWED, AUTH_NONE);
+	    cupsdSendError(con, HTTP_METHOD_NOT_ALLOWED, CUPSD_AUTH_NONE);
 	    cupsdCloseClient(con);
 	    return;
 	  }
@@ -950,7 +960,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	else
 	{
 	  cupsdLogMessage(CUPSD_LOG_ERROR, "Bad operation \"%s\"!", operation);
-	  cupsdSendError(con, HTTP_BAD_REQUEST, AUTH_NONE);
+	  cupsdSendError(con, HTTP_BAD_REQUEST, CUPSD_AUTH_NONE);
 	  cupsdCloseClient(con);
 	  return;
 	}
@@ -982,7 +992,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 
 	if (status != HTTP_OK && status != HTTP_CONTINUE)
 	{
-	  cupsdSendError(con, HTTP_BAD_REQUEST, AUTH_NONE);
+	  cupsdSendError(con, HTTP_BAD_REQUEST, CUPSD_AUTH_NONE);
 	  cupsdCloseClient(con);
 	  return;
 	}
@@ -1050,7 +1060,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
       * HTTP/1.1 and higher require the "Host:" field...
       */
 
-      if (!cupsdSendError(con, HTTP_BAD_REQUEST, AUTH_NONE))
+      if (!cupsdSendError(con, HTTP_BAD_REQUEST, CUPSD_AUTH_NONE))
       {
 	cupsdCloseClient(con);
 	return;
@@ -1062,9 +1072,9 @@ cupsdReadClient(cupsd_client_t *con)	/* 
       * Do OPTIONS command...
       */
 
-      if (con->best && con->best->type != AUTH_NONE)
+      if (con->best && con->best->type != CUPSD_AUTH_NONE)
       {
-	if (!cupsdSendHeader(con, HTTP_UNAUTHORIZED, NULL, AUTH_NONE))
+	if (!cupsdSendHeader(con, HTTP_UNAUTHORIZED, NULL, CUPSD_AUTH_NONE))
 	{
 	  cupsdCloseClient(con);
 	  return;
@@ -1079,7 +1089,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
         * Do encryption stuff...
 	*/
 
-	if (!cupsdSendHeader(con, HTTP_SWITCHING_PROTOCOLS, NULL, AUTH_NONE))
+	if (!cupsdSendHeader(con, HTTP_SWITCHING_PROTOCOLS, NULL, CUPSD_AUTH_NONE))
 	{
 	  cupsdCloseClient(con);
 	  return;
@@ -1102,7 +1112,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	  return;
 	}
 #else
-	if (!cupsdSendError(con, HTTP_NOT_IMPLEMENTED, AUTH_NONE))
+	if (!cupsdSendError(con, HTTP_NOT_IMPLEMENTED, CUPSD_AUTH_NONE))
 	{
 	  cupsdCloseClient(con);
 	  return;
@@ -1110,7 +1120,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 #endif /* HAVE_SSL */
       }
 
-      if (!cupsdSendHeader(con, HTTP_OK, NULL, AUTH_NONE))
+      if (!cupsdSendHeader(con, HTTP_OK, NULL, CUPSD_AUTH_NONE))
       {
 	cupsdCloseClient(con);
 	return;
@@ -1132,7 +1142,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
       * Protect against malicious users!
       */
 
-      if (!cupsdSendError(con, HTTP_FORBIDDEN, AUTH_NONE))
+      if (!cupsdSendError(con, HTTP_FORBIDDEN, CUPSD_AUTH_NONE))
       {
 	cupsdCloseClient(con);
 	return;
@@ -1148,7 +1158,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
         * Do encryption stuff...
 	*/
 
-	if (!cupsdSendHeader(con, HTTP_SWITCHING_PROTOCOLS, NULL, AUTH_NONE))
+	if (!cupsdSendHeader(con, HTTP_SWITCHING_PROTOCOLS, NULL, CUPSD_AUTH_NONE))
 	{
 	  cupsdCloseClient(con);
 	  return;
@@ -1171,7 +1181,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	  return;
 	}
 #else
-	if (!cupsdSendError(con, HTTP_NOT_IMPLEMENTED, AUTH_NONE))
+	if (!cupsdSendError(con, HTTP_NOT_IMPLEMENTED, CUPSD_AUTH_NONE))
 	{
 	  cupsdCloseClient(con);
 	  return;
@@ -1184,7 +1194,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
         cupsdLogMessage(CUPSD_LOG_DEBUG2,
 	                "cupsdReadClient: Unauthorized request for %s...\n",
 	                con->uri);
-	cupsdSendError(con, status, AUTH_NONE);
+	cupsdSendError(con, status, CUPSD_AUTH_NONE);
 	cupsdCloseClient(con);
 	return;
       }
@@ -1198,7 +1208,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	  * Send 100-continue header...
 	  */
 
-	  if (!cupsdSendHeader(con, HTTP_CONTINUE, NULL, AUTH_NONE))
+	  if (!cupsdSendHeader(con, HTTP_CONTINUE, NULL, CUPSD_AUTH_NONE))
 	  {
 	    cupsdCloseClient(con);
 	    return;
@@ -1210,7 +1220,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	  * Send 417-expectation-failed header...
 	  */
 
-	  if (!cupsdSendHeader(con, HTTP_EXPECTATION_FAILED, NULL, AUTH_NONE))
+	  if (!cupsdSendHeader(con, HTTP_EXPECTATION_FAILED, NULL, CUPSD_AUTH_NONE))
 	  {
 	    cupsdCloseClient(con);
 	    return;
@@ -1244,7 +1254,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 		snprintf(con->uri, sizeof(con->uri), "/ppd/%s.ppd", p->name);
 	      else
 	      {
-		if (!cupsdSendError(con, HTTP_NOT_FOUND, AUTH_NONE))
+		if (!cupsdSendError(con, HTTP_NOT_FOUND, CUPSD_AUTH_NONE))
 		{
 		  cupsdCloseClient(con);
 		  return;
@@ -1316,7 +1326,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 
               if (!cupsdSendCommand(con, con->command, con->options, 0))
 	      {
-		if (!cupsdSendError(con, HTTP_NOT_FOUND, AUTH_NONE))
+		if (!cupsdSendError(con, HTTP_NOT_FOUND, CUPSD_AUTH_NONE))
 		{
 		  cupsdCloseClient(con);
 		  return;
@@ -1340,7 +1350,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	      * /admin/conf...
 	      */
 
-	      if (!cupsdSendError(con, HTTP_FORBIDDEN, AUTH_NONE))
+	      if (!cupsdSendError(con, HTTP_FORBIDDEN, CUPSD_AUTH_NONE))
 	      {
 		cupsdCloseClient(con);
 		return;
@@ -1357,7 +1367,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
               if ((filename = get_file(con, &filestats, buf,
 	                               sizeof(buf))) == NULL)
 	      {
-		if (!cupsdSendError(con, HTTP_NOT_FOUND, AUTH_NONE))
+		if (!cupsdSendError(con, HTTP_NOT_FOUND, CUPSD_AUTH_NONE))
 		{
 		  cupsdCloseClient(con);
 		  return;
@@ -1377,7 +1387,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 
         	if (!cupsdSendCommand(con, con->command, con->options, 0))
 		{
-		  if (!cupsdSendError(con, HTTP_NOT_FOUND, AUTH_NONE))
+		  if (!cupsdSendError(con, HTTP_NOT_FOUND, CUPSD_AUTH_NONE))
 		  {
 		    cupsdCloseClient(con);
 		    return;
@@ -1393,7 +1403,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 
 	      if (!check_if_modified(con, &filestats))
               {
-        	if (!cupsdSendError(con, HTTP_NOT_MODIFIED, AUTH_NONE))
+        	if (!cupsdSendError(con, HTTP_NOT_MODIFIED, CUPSD_AUTH_NONE))
 		{
 		  cupsdCloseClient(con);
 		  return;
@@ -1433,7 +1443,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	      * Request too large...
 	      */
 
-              if (!cupsdSendError(con, HTTP_REQUEST_TOO_LARGE, AUTH_NONE))
+              if (!cupsdSendError(con, HTTP_REQUEST_TOO_LARGE, CUPSD_AUTH_NONE))
 	      {
 		cupsdCloseClient(con);
 		return;
@@ -1447,7 +1457,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	      * Negative content lengths are invalid!
 	      */
 
-              if (!cupsdSendError(con, HTTP_BAD_REQUEST, AUTH_NONE))
+              if (!cupsdSendError(con, HTTP_BAD_REQUEST, CUPSD_AUTH_NONE))
 	      {
 		cupsdCloseClient(con);
 		return;
@@ -1542,7 +1552,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
               if ((filename = get_file(con, &filestats, buf,
 	                               sizeof(buf))) == NULL)
 	      {
-		if (!cupsdSendError(con, HTTP_NOT_FOUND, AUTH_NONE))
+		if (!cupsdSendError(con, HTTP_NOT_FOUND, CUPSD_AUTH_NONE))
 		{
 		  cupsdCloseClient(con);
 		  return;
@@ -1559,7 +1569,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	        * Only POST to CGI's...
 		*/
 
-		if (!cupsdSendError(con, HTTP_UNAUTHORIZED, AUTH_NONE))
+		if (!cupsdSendError(con, HTTP_UNAUTHORIZED, CUPSD_AUTH_NONE))
 		{
 		  cupsdCloseClient(con);
 		  return;
@@ -1582,7 +1592,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	      * /admin/conf...
 	      */
 
-	      if (!cupsdSendError(con, HTTP_FORBIDDEN, AUTH_NONE))
+	      if (!cupsdSendError(con, HTTP_FORBIDDEN, CUPSD_AUTH_NONE))
 	      {
 		cupsdCloseClient(con);
 		return;
@@ -1608,7 +1618,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	      * Request too large...
 	      */
 
-              if (!cupsdSendError(con, HTTP_REQUEST_TOO_LARGE, AUTH_NONE))
+              if (!cupsdSendError(con, HTTP_REQUEST_TOO_LARGE, CUPSD_AUTH_NONE))
 	      {
 		cupsdCloseClient(con);
 		return;
@@ -1622,7 +1632,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	      * Negative content lengths are invalid!
 	      */
 
-              if (!cupsdSendError(con, HTTP_BAD_REQUEST, AUTH_NONE))
+              if (!cupsdSendError(con, HTTP_BAD_REQUEST, CUPSD_AUTH_NONE))
 	      {
 		cupsdCloseClient(con);
 		return;
@@ -1639,19 +1649,23 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	                    request_id ++);
 	    con->file = open(con->filename, O_WRONLY | O_CREAT | O_TRUNC, 0640);
 
-            cupsdLogMessage(CUPSD_LOG_DEBUG2,
-	                    "cupsdReadClient: %d REQUEST %s=%d", con->http.fd,
-	                    con->filename, con->file);
-
 	    if (con->file < 0)
 	    {
-	      if (!cupsdSendError(con, HTTP_REQUEST_TOO_LARGE, AUTH_NONE))
+	      cupsdLogMessage(CUPSD_LOG_ERROR,
+	                      "Unable to create request file %s: %s",
+	                      con->filename, strerror(errno));
+
+	      if (!cupsdSendError(con, HTTP_REQUEST_TOO_LARGE, CUPSD_AUTH_NONE))
 	      {
 		cupsdCloseClient(con);
 		return;
 	      }
 	    }
 
+            cupsdLogMessage(CUPSD_LOG_DEBUG2,
+	                    "cupsdReadClient: %d REQUEST %s=%d", con->http.fd,
+	                    con->filename, con->file);
+
 	    fchmod(con->file, 0640);
 	    fchown(con->file, RunUser, Group);
 	    fcntl(con->file, F_SETFD, fcntl(con->file, F_GETFD) | FD_CLOEXEC);
@@ -1659,7 +1673,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 
 	case HTTP_DELETE :
 	case HTTP_TRACE :
-            cupsdSendError(con, HTTP_NOT_IMPLEMENTED, AUTH_NONE);
+            cupsdSendError(con, HTTP_NOT_IMPLEMENTED, CUPSD_AUTH_NONE);
 	    cupsdCloseClient(con);
 	    return;
 
@@ -1678,7 +1692,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 		snprintf(con->uri, sizeof(con->uri), "/ppd/%s.ppd", p->name);
 	      else
 	      {
-		if (!cupsdSendError(con, HTTP_NOT_FOUND, AUTH_NONE))
+		if (!cupsdSendError(con, HTTP_NOT_FOUND, CUPSD_AUTH_NONE))
 		{
 		  cupsdCloseClient(con);
 		  return;
@@ -1700,7 +1714,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	      * CGI output...
 	      */
 
-              if (!cupsdSendHeader(con, HTTP_OK, "text/html", AUTH_NONE))
+              if (!cupsdSendHeader(con, HTTP_OK, "text/html", CUPSD_AUTH_NONE))
 	      {
 		cupsdCloseClient(con);
 		return;
@@ -1732,7 +1746,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	      * /admin/conf...
 	      */
 
-	      if (!cupsdSendError(con, HTTP_FORBIDDEN, AUTH_NONE))
+	      if (!cupsdSendError(con, HTTP_FORBIDDEN, CUPSD_AUTH_NONE))
 	      {
 		cupsdCloseClient(con);
 		return;
@@ -1743,7 +1757,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	    else if ((filename = get_file(con, &filestats, buf,
 	                                  sizeof(buf))) == NULL)
 	    {
-	      if (!cupsdSendHeader(con, HTTP_NOT_FOUND, "text/html", AUTH_NONE))
+	      if (!cupsdSendHeader(con, HTTP_NOT_FOUND, "text/html", CUPSD_AUTH_NONE))
 	      {
 		cupsdCloseClient(con);
 		return;
@@ -1753,7 +1767,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	    }
 	    else if (!check_if_modified(con, &filestats))
             {
-              if (!cupsdSendError(con, HTTP_NOT_MODIFIED, AUTH_NONE))
+              if (!cupsdSendError(con, HTTP_NOT_MODIFIED, CUPSD_AUTH_NONE))
 	      {
 		cupsdCloseClient(con);
 		return;
@@ -1773,7 +1787,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	      else
 		snprintf(line, sizeof(line), "%s/%s", type->super, type->type);
 
-              if (!cupsdSendHeader(con, HTTP_OK, line, AUTH_NONE))
+              if (!cupsdSendHeader(con, HTTP_OK, line, CUPSD_AUTH_NONE))
 	      {
 		cupsdCloseClient(con);
 		return;
@@ -1862,7 +1876,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	      unlink(con->filename);
 	      cupsdClearString(&con->filename);
 
-              if (!cupsdSendError(con, HTTP_REQUEST_TOO_LARGE, AUTH_NONE))
+              if (!cupsdSendError(con, HTTP_REQUEST_TOO_LARGE, CUPSD_AUTH_NONE))
 	      {
 		cupsdCloseClient(con);
 		return;
@@ -1902,7 +1916,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	    unlink(con->filename);
 	    cupsdClearString(&con->filename);
 
-            if (!cupsdSendError(con, HTTP_REQUEST_TOO_LARGE, AUTH_NONE))
+            if (!cupsdSendError(con, HTTP_REQUEST_TOO_LARGE, CUPSD_AUTH_NONE))
 	    {
 	      cupsdCloseClient(con);
 	      return;
@@ -1919,7 +1933,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	  * Return the status to the client...
 	  */
 
-          if (!cupsdSendError(con, status, AUTH_NONE))
+          if (!cupsdSendError(con, status, CUPSD_AUTH_NONE))
 	  {
 	    cupsdCloseClient(con);
 	    return;
@@ -1950,7 +1964,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	                      "cupsdReadClient: %d IPP Read Error!",
 			      con->http.fd);
 
-	      cupsdSendError(con, HTTP_BAD_REQUEST, AUTH_NONE);
+	      cupsdSendError(con, HTTP_BAD_REQUEST, CUPSD_AUTH_NONE);
 	      cupsdCloseClient(con);
 	      return;
 	    }
@@ -1958,7 +1972,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	    {
               if (con->http.state == HTTP_POST_SEND)
 	      {
-		cupsdSendError(con, HTTP_BAD_REQUEST, AUTH_NONE);
+		cupsdSendError(con, HTTP_BAD_REQUEST, CUPSD_AUTH_NONE);
 		cupsdCloseClient(con);
 		return;
 	      }
@@ -1978,18 +1992,22 @@ cupsdReadClient(cupsd_client_t *con)	/* 
             cupsdSetStringf(&con->filename, "%s/%08x", RequestRoot, request_id ++);
 	    con->file = open(con->filename, O_WRONLY | O_CREAT | O_TRUNC, 0640);
 
-            cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdReadClient: %d REQUEST %s=%d", con->http.fd,
-	                    con->filename, con->file);
-
 	    if (con->file < 0)
 	    {
-	      if (!cupsdSendError(con, HTTP_REQUEST_TOO_LARGE, AUTH_NONE))
+	      cupsdLogMessage(CUPSD_LOG_ERROR,
+	                      "Unable to create request file %s: %s",
+	                      con->filename, strerror(errno));
+
+	      if (!cupsdSendError(con, HTTP_REQUEST_TOO_LARGE, CUPSD_AUTH_NONE))
 	      {
 		cupsdCloseClient(con);
 		return;
 	      }
 	    }
 
+            cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdReadClient: %d REQUEST %s=%d", con->http.fd,
+	                    con->filename, con->file);
+
 	    fchmod(con->file, 0640);
 	    fchown(con->file, RunUser, Group);
             fcntl(con->file, F_SETFD, fcntl(con->file, F_GETFD) | FD_CLOEXEC);
@@ -2025,7 +2043,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 		unlink(con->filename);
 		cupsdClearString(&con->filename);
 
-        	if (!cupsdSendError(con, HTTP_REQUEST_TOO_LARGE, AUTH_NONE))
+        	if (!cupsdSendError(con, HTTP_REQUEST_TOO_LARGE, CUPSD_AUTH_NONE))
 		{
 		  cupsdCloseClient(con);
 		  return;
@@ -2081,7 +2099,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 		con->request = NULL;
               }
 
-              if (!cupsdSendError(con, HTTP_REQUEST_TOO_LARGE, AUTH_NONE))
+              if (!cupsdSendError(con, HTTP_REQUEST_TOO_LARGE, CUPSD_AUTH_NONE))
 	      {
 		cupsdCloseClient(con);
 		return;
@@ -2092,7 +2110,7 @@ cupsdReadClient(cupsd_client_t *con)	/* 
 	    {
 	      if (!cupsdSendCommand(con, con->command, con->options, 0))
 	      {
-		if (!cupsdSendError(con, HTTP_NOT_FOUND, AUTH_NONE))
+		if (!cupsdSendError(con, HTTP_NOT_FOUND, CUPSD_AUTH_NONE))
 		{
 		  cupsdCloseClient(con);
 		  return;
@@ -2232,7 +2250,7 @@ cupsdSendError(cupsd_client_t *con,	/* I
   * never disable it in that case.
   */
 
-  if (code >= HTTP_BAD_REQUEST && con->http.auth_type != AUTH_NEGOTIATE)
+  if (code >= HTTP_BAD_REQUEST && con->http.auth_type != CUPSD_AUTH_NEGOTIATE)
     con->http.keep_alive = HTTP_KEEPALIVE_OFF;
 
  /*
@@ -2351,7 +2369,11 @@ cupsdSendHeader(
     char           *type,		/* I - MIME type of document */
     int            auth_type)		/* I - Type of authentication */
 {
-  char	auth_str[1024];			/* Authorization string */
+  char		auth_str[1024];		/* Authorization string */
+#ifdef HAVE_GSSAPI
+  static char	*gss_buf = NULL;	/* Kerberos auth data buffer */
+  static int	gss_bufsize = 0;	/* Size of Kerberos auth data buffer */
+#endif /* HAVE_GSSAPI */
 
 
  /*
@@ -2394,9 +2416,9 @@ cupsdSendHeader(
 
   if (code == HTTP_UNAUTHORIZED)
   {
-    if (auth_type == AUTH_NONE)
+    if (auth_type == CUPSD_AUTH_NONE)
     {
-      if (!con->best || con->best->type <= AUTH_NONE)
+      if (!con->best || con->best->type <= CUPSD_AUTH_NONE)
 	auth_type = DefaultAuthType;
       else
 	auth_type = con->best->type;
@@ -2404,18 +2426,18 @@ cupsdSendHeader(
 
     auth_str[0] = '\0';
 
-    if (auth_type == AUTH_BASIC || auth_type == AUTH_BASICDIGEST)
+    if (auth_type == CUPSD_AUTH_BASIC || auth_type == CUPSD_AUTH_BASICDIGEST)
       strlcpy(auth_str, "Basic realm=\"CUPS\"", sizeof(auth_str));
-    else if (auth_type == AUTH_DIGEST)
+    else if (auth_type == CUPSD_AUTH_DIGEST)
       snprintf(auth_str, sizeof(auth_str), "Digest realm=\"CUPS\", nonce=\"%s\"",
 	       con->http.hostname);
 #ifdef HAVE_GSSAPI
-    else if (auth_type == AUTH_NEGOTIATE && con->gss_output_token.length == 0)
+    else if (auth_type == CUPSD_AUTH_NEGOTIATE && con->gss_output_token.length == 0)
       strlcpy(auth_str, "Negotiate", sizeof(auth_str));
 #endif /* HAVE_GSSAPI */
 
 #ifdef HAVE_AUTHORIZATION_H
-    if (con->best && auth_type != AUTH_NEGOTIATE)
+    if (con->best && auth_type != CUPSD_AUTH_NEGOTIATE)
     {
       int 	 i;			/* Looping var */
       char	*auth_key;		/* Auth key buffer */
@@ -2460,23 +2482,57 @@ cupsdSendHeader(
   * non-401 replies...
   */
 
-  if (con->gss_output_token.length > 0)
+  if (con->gss_output_token.length > 0 && con->gss_output_token.length <= 65536)
   {
-    char	buf[2048];		/* Output token buffer */
     OM_uint32	minor_status;		/* Minor status code */
+    int		bufsize;		/* Size of output token buffer */
+
+
+    bufsize = con->gss_output_token.length * 4 / 3 + 2;
+
+    if (bufsize > gss_bufsize)
+    {
+      char	*buf;			/* New buffer */
+
+
+      bufsize = (bufsize + 1023) & 1023;/* Round up */
+
+      if (gss_buf)
+        buf = realloc(gss_buf, bufsize);
+      else
+        buf = malloc(bufsize);
 
+      if (!buf)
+      {
+	cupsdLogMessage(CUPSD_LOG_ERROR,
+			"Unable to allocate %d bytes for Kerberos credentials!",
+			bufsize);
+	return (0);
+      }
 
-    httpEncode64_2(buf, sizeof(buf),
-    	           con->gss_output_token.value,
+      gss_buf     = buf;
+      gss_bufsize = bufsize;
+    }
+
+    httpEncode64_2(gss_buf, gss_bufsize,
+		   con->gss_output_token.value,
 		   con->gss_output_token.length);
     gss_release_buffer(&minor_status, &con->gss_output_token);
 
     cupsdLogMessage(CUPSD_LOG_DEBUG,
-                    "cupsdSendHeader: WWW-Authenticate: Negotiate %s", buf);
+		    "cupsdSendHeader: WWW-Authenticate: Negotiate %s", gss_buf);
 
-    if (httpPrintf(HTTP(con), "WWW-Authenticate: Negotiate %s\r\n", buf) < 0)
+    if (httpPrintf(HTTP(con), "WWW-Authenticate: Negotiate %s\r\n",
+                   gss_buf) < 0)
       return (0);
   }
+  else if (con->gss_output_token.length > 65536)
+  {
+    cupsdLogMessage(CUPSD_LOG_ERROR,
+                    "Kerberos credentials larger than 64k (%d)!",
+		    (int)con->gss_output_token.length);
+    return (0);
+  }
 #endif /* HAVE_GSSAPI */
 
   if (con->language && strcmp(con->language->language, "C"))
@@ -2619,7 +2675,7 @@ cupsdWriteClient(cupsd_client_t *con)	/*
 
             if (!strncasecmp(buf, "Location:", 9))
 	    {
-  	      cupsdSendHeader(con, HTTP_SEE_OTHER, NULL, AUTH_NONE);
+  	      cupsdSendHeader(con, HTTP_SEE_OTHER, NULL, CUPSD_AUTH_NONE);
 	      con->sent_header = 2;
 
 	      if (httpPrintf(HTTP(con), "Content-Length: 0\r\n") < 0)
@@ -2627,12 +2683,12 @@ cupsdWriteClient(cupsd_client_t *con)	/*
 	    }
 	    else if (!strncasecmp(buf, "Status:", 7))
 	    {
-  	      cupsdSendError(con, (http_status_t)atoi(buf + 7), AUTH_NONE);
+  	      cupsdSendError(con, (http_status_t)atoi(buf + 7), CUPSD_AUTH_NONE);
 	      con->sent_header = 2;
 	    }
 	    else
 	    {
-  	      cupsdSendHeader(con, HTTP_OK, NULL, AUTH_NONE);
+  	      cupsdSendHeader(con, HTTP_OK, NULL, CUPSD_AUTH_NONE);
 	      con->sent_header = 1;
 
 	      if (con->http.version == HTTP_1_1)
@@ -4220,7 +4276,7 @@ pipe_command(cupsd_client_t *con,	/* I -
   char		argbuf[10240],		/* Argument buffer */
 		*argv[100],		/* Argument strings */
 		*envp[MAX_ENV + 20];	/* Environment variables */
-  char		auth_type[256],		/* AUTH_TYPE environment variable */
+  char		auth_type[256],		/* CUPSD_AUTH_TYPE environment variable */
 		content_length[1024],	/* CONTENT_LENGTH environment variable */
 		content_type[1024],	/* CONTENT_TYPE environment variable */
 		http_cookie[32768],	/* HTTP_COOKIE environment variable */
@@ -4236,6 +4292,10 @@ pipe_command(cupsd_client_t *con,	/* I -
 		server_name[1024],	/* SERVER_NAME environment variable */
 		server_port[1024];	/* SERVER_PORT environment variable */
   ipp_attribute_t *attr;		/* attributes-natural-language attribute */
+#ifdef HAVE_GSSAPI
+  krb5_ccache	ccache = NULL;		/* Kerberos credentials */
+  char		krb5ccname[1024];	/* KRB5CCNAME environment variable */
+#endif /* HAVE_GSSAPI */
 
 
  /*
@@ -4362,7 +4422,7 @@ pipe_command(cupsd_client_t *con,	/* I -
 
   if (con->username[0])
   {
-    snprintf(auth_type, sizeof(auth_type), "AUTH_TYPE=%s",
+    snprintf(auth_type, sizeof(auth_type), "CUPSD_AUTH_TYPE=%s",
              httpGetField(HTTP(con), HTTP_FIELD_AUTHORIZATION));
 
     if ((uriptr = strchr(auth_type + 10, ' ')) != NULL)
@@ -4455,6 +4515,120 @@ pipe_command(cupsd_client_t *con,	/* I -
     snprintf(remote_user, sizeof(remote_user), "REMOTE_USER=%s", con->username);
 
     envp[envc ++] = remote_user;
+
+   /*
+    * Save Kerberos credentials, if any...
+    */
+
+#ifdef HAVE_GSSAPI
+    if (con->gss_have_creds)
+    {
+#  if !defined(HAVE_KRB5_CC_NEW_UNIQUE) && !defined(HAVE_HEIMDAL)
+      cupsdLogMessage(CUPSD_LOG_INFO,
+		      "Sorry, your version of Kerberos does not support "
+		      "delegated credentials!");
+
+#  else
+      krb5_error_code	error;		/* Kerberos error code */
+      OM_uint32		major_status,	/* Major status code */
+			minor_status;	/* Minor status code */
+      krb5_principal	principal;	/* Kerberos principal */
+
+
+#   ifdef __APPLE__
+     /*
+      * If the weak-linked GSSAPI/Kerberos library is not present, don't try
+      * to use it...
+      */
+
+      if (krb5_init_context != NULL)
+      {
+#    endif /* __APPLE__ */
+
+     /*
+      * We MUST create a file-based cache because memory-based caches are
+      * only valid for the current process/address space.
+      *
+      * Due to various bugs/features in different versions of Kerberos, we
+      * need either the krb5_cc_new_unique() function or Heimdal's version
+      * of krb5_cc_gen_new() to create a new FILE: credential cache that
+      * can be passed to the backend.  These functions create a temporary
+      * file (typically in /tmp) containing the cached credentials, which
+      * are removed when we have successfully printed a job.
+      */
+
+#    ifdef HAVE_KRB5_CC_NEW_UNIQUE
+      if ((error = krb5_cc_new_unique(KerberosContext, "FILE", NULL,
+				      &ccache)) != 0)
+#    else /* HAVE_HEIMDAL */
+      if ((error = krb5_cc_gen_new(KerberosContext, &krb5_fcc_ops,
+				   &ccache)) != 0)
+#    endif /* HAVE_KRB5_CC_NEW_UNIQUE */
+      {
+	cupsdLogMessage(CUPSD_LOG_ERROR,
+			"Unable to create new credentials cache (%d/%s)",
+			error, strerror(errno));
+	ccache = NULL;
+      }
+      else if ((error = krb5_parse_name(KerberosContext, con->username,
+				        &principal)) != 0)
+      {
+	cupsdLogMessage(CUPSD_LOG_ERROR,
+			"Unable to parse kerberos username (%d/%s)", error,
+			strerror(errno));
+	krb5_cc_destroy(KerberosContext, ccache);
+	ccache = NULL;
+      }
+      else if ((error = krb5_cc_initialize(KerberosContext, ccache,
+                                           principal)))
+      {
+	cupsdLogMessage(CUPSD_LOG_ERROR,
+			"Unable to initialize credentials cache (%d/%s)", error,
+			strerror(errno));
+	krb5_cc_destroy(KerberosContext, ccache);
+	krb5_free_principal(KerberosContext, principal);
+	ccache = NULL;
+      }
+      else
+      {
+	krb5_free_principal(KerberosContext, principal);
+
+       /*
+	* Copy the user's credentials to the new cache file...
+	*/
+
+	major_status = gss_krb5_copy_ccache(&minor_status,
+	                                    con->gss_delegated_cred, ccache);
+
+	if (GSS_ERROR(major_status))
+	{
+	  cupsdLogGSSMessage(CUPSD_LOG_ERROR, major_status, minor_status,
+			     "Unable to import client credentials cache");
+	  krb5_cc_destroy(KerberosContext, ccache);
+	  ccache = NULL;
+	}
+	else
+	{
+	 /*
+	  * Add the KRB5CCNAME environment variable to the job so that the
+	  * backend can use the credentials when printing.
+	  */
+
+	  snprintf(krb5ccname, sizeof(krb5ccname), "KRB5CCNAME=FILE:%s",
+		   krb5_cc_get_name(KerberosContext, ccache));
+          envp[envc++] = krb5ccname;
+
+	  if (!RunUser)
+	    chown(krb5_cc_get_name(KerberosContext, ccache), User, Group);
+        }
+     }
+#    ifdef __APPLE__
+     }
+#    endif /* __APPLE__ */
+#  endif /* HAVE_KRB5_CC_NEW_UNIQUE || HAVE_HEIMDAL */
+    }
+#endif /* HAVE_GSSAPI */
+
   }
 
   if (con->http.version == HTTP_1_1)
@@ -4568,7 +4742,11 @@ pipe_command(cupsd_client_t *con,	/* I -
     */
 
     if (con->username[0])
-      cupsdAddCert(pid, con->username);
+#ifdef HAVE_GSSAPI
+      cupsdAddCert(pid, con->username, ccache);
+#else
+      cupsdAddCert(pid, con->username, NULL);
+#endif /* HAVE_GSSAPI */
 
     cupsdLogMessage(CUPSD_LOG_DEBUG, "[CGI] %s started - PID = %d",
                     command, pid);
@@ -4604,7 +4782,7 @@ write_file(cupsd_client_t *con,		/* I - 
 
   con->pipe_pid = 0;
 
-  if (!cupsdSendHeader(con, code, type, AUTH_NONE))
+  if (!cupsdSendHeader(con, code, type, CUPSD_AUTH_NONE))
     return (0);
 
   if (httpPrintf(HTTP(con), "Last-Modified: %s\r\n",
diff -up cups-1.3.5/scheduler/cups-polld.c.1.3.x cups-1.3.5/scheduler/cups-polld.c
--- cups-1.3.5/scheduler/cups-polld.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/scheduler/cups-polld.c	2008-02-14 13:03:30.000000000 +0000
@@ -144,7 +144,7 @@ main(int  argc,				/* I - Number of comm
   * Loop forever, asking for available printers and classes...
   */
 
-  for (http = NULL;;)
+  for (http = NULL; !ferror(stderr);)
   {
    /*
     * Open a connection to the server...
@@ -180,6 +180,8 @@ main(int  argc,				/* I - Number of comm
     if (remain > 0 && !restart_polling)
       sleep(remain);
   }
+
+  return (1);
 }
 
 
diff -up cups-1.3.5/scheduler/classes.c.1.3.x cups-1.3.5/scheduler/classes.c
--- cups-1.3.5/scheduler/classes.c.1.3.x	2007-11-30 03:37:11.000000000 +0000
+++ cups-1.3.5/scheduler/classes.c	2008-02-14 13:03:30.000000000 +0000
@@ -393,7 +393,7 @@ cupsdLoadAllClasses(void)
       {
         cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of classes.conf.", linenum);
-        return;
+        break;
       }
     }
     else if (!strcasecmp(line, "</Class>"))
@@ -407,14 +407,14 @@ cupsdLoadAllClasses(void)
       {
         cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of classes.conf.", linenum);
-        return;
+        break;
       }
     }
     else if (!p)
     {
       cupsdLogMessage(CUPSD_LOG_ERROR,
                       "Syntax error on line %d of classes.conf.", linenum);
-      return;
+      break;
     }
     else if (!strcasecmp(line, "AuthInfoRequired"))
     {
@@ -458,7 +458,7 @@ cupsdLoadAllClasses(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of classes.conf.", linenum);
-	return;
+	break;
       }
       else if ((temp = cupsdFindPrinter(value)) == NULL)
       {
@@ -504,7 +504,7 @@ cupsdLoadAllClasses(void)
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of classes.conf.",
 	                linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "StateMessage"))
@@ -546,7 +546,7 @@ cupsdLoadAllClasses(void)
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of classes.conf.",
 	                linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "Shared"))
@@ -568,9 +568,9 @@ cupsdLoadAllClasses(void)
       else
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
-	                "Syntax error on line %d of printers.conf.",
+	                "Syntax error on line %d of classes.conf.",
 	                linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "JobSheets"))
@@ -609,7 +609,7 @@ cupsdLoadAllClasses(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of classes.conf.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "AllowUser"))
@@ -623,7 +623,7 @@ cupsdLoadAllClasses(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of classes.conf.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "DenyUser"))
@@ -637,7 +637,7 @@ cupsdLoadAllClasses(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of classes.conf.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "QuotaPeriod"))
@@ -648,7 +648,7 @@ cupsdLoadAllClasses(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of classes.conf.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "PageLimit"))
@@ -659,7 +659,7 @@ cupsdLoadAllClasses(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of classes.conf.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "KLimit"))
@@ -670,7 +670,7 @@ cupsdLoadAllClasses(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of classes.conf.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "OpPolicy"))
@@ -694,7 +694,7 @@ cupsdLoadAllClasses(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of classes.conf.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "ErrorPolicy"))
@@ -705,7 +705,7 @@ cupsdLoadAllClasses(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of classes.conf.", linenum);
-	return;
+	break;
       }
     }
     else
diff -up cups-1.3.5/scheduler/cert.h.1.3.x cups-1.3.5/scheduler/cert.h
--- cups-1.3.5/scheduler/cert.h.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/scheduler/cert.h	2008-02-14 13:03:30.000000000 +0000
@@ -4,7 +4,7 @@
  *   Authentication certificate definitions for the Common UNIX
  *   Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2005 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -24,6 +24,9 @@ typedef struct cupsd_cert_s
   int		pid;			/* Process ID (0 for root certificate) */
   char		certificate[33];	/* 32 hex characters, or 128 bits */
   char		username[33];		/* Authenticated username */
+#ifdef HAVE_GSSAPI
+  krb5_ccache	ccache;			/* Kerberos credential cache */
+#endif /* HAVE_GSSAPI */
 } cupsd_cert_t;
 
 
@@ -39,7 +42,8 @@ VAR time_t		RootCertTime;	/* Root certif
  * Prototypes...
  */
 
-extern void		cupsdAddCert(int pid, const char *username);
+extern void		cupsdAddCert(int pid, const char *username,
+			             void *ccache);
 extern void		cupsdDeleteCert(int pid);
 extern void		cupsdDeleteAllCerts(void);
 extern const char	*cupsdFindCert(const char *certificate);
diff -up cups-1.3.5/scheduler/policy.c.1.3.x cups-1.3.5/scheduler/policy.c
--- cups-1.3.5/scheduler/policy.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/scheduler/policy.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Policy routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2006 by Easy Software Products, all rights reserved.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -105,7 +105,7 @@ cupsdAddPolicyOp(cupsd_policy_t   *p,	/*
     p->num_ops ++;
 
     temp->op    = op;
-    temp->limit = AUTH_LIMIT_IPP;
+    temp->limit = CUPSD_AUTH_LIMIT_IPP;
 
     if (po)
     {
@@ -125,12 +125,12 @@ cupsdAddPolicyOp(cupsd_policy_t   *p,	/*
       for (i = 0; i < po->num_allow; i ++)
         switch (po->allow[i].type)
 	{
-	  case AUTH_IP :
+	  case CUPSD_AUTH_IP :
 	      cupsdAllowIP(temp, po->allow[i].mask.ip.address,
 	              po->allow[i].mask.ip.netmask);
 	      break;
 
-          case AUTH_INTERFACE :
+          case CUPSD_AUTH_INTERFACE :
 	      snprintf(name, sizeof(name), "@IF(%s)",
 	               po->allow[i].mask.name.name);
               cupsdAllowHost(temp, name);
@@ -144,12 +144,12 @@ cupsdAddPolicyOp(cupsd_policy_t   *p,	/*
       for (i = 0; i < po->num_deny; i ++)
         switch (po->deny[i].type)
 	{
-	  case AUTH_IP :
+	  case CUPSD_AUTH_IP :
 	      cupsdDenyIP(temp, po->deny[i].mask.ip.address,
 	              po->deny[i].mask.ip.netmask);
 	      break;
 
-          case AUTH_INTERFACE :
+          case CUPSD_AUTH_INTERFACE :
 	      snprintf(name, sizeof(name), "@IF(%s)",
 	               po->deny[i].mask.name.name);
               cupsdDenyHost(temp, name);
diff -up cups-1.3.5/scheduler/auth.h.1.3.x cups-1.3.5/scheduler/auth.h
--- cups-1.3.5/scheduler/auth.h.1.3.x	2007-08-08 21:50:42.000000000 +0100
+++ cups-1.3.5/scheduler/auth.h	2008-02-14 13:03:30.000000000 +0000
@@ -4,7 +4,7 @@
  *   Authorization definitions for the Common UNIX Printing System (CUPS)
  *   scheduler.
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2006 by Easy Software Products, all rights reserved.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -25,36 +25,36 @@
  * HTTP authorization types and levels...
  */
 
-#define AUTH_DEFAULT		-1	/* Use DefaultAuthType */
-#define AUTH_NONE		0	/* No authentication */
-#define AUTH_BASIC		1	/* Basic authentication */
-#define AUTH_DIGEST		2	/* Digest authentication */
-#define AUTH_BASICDIGEST	3	/* Basic authentication w/passwd.md5 */
-#define AUTH_NEGOTIATE		4	/* Kerberos authentication */
-
-#define AUTH_ANON		0	/* Anonymous access */
-#define AUTH_USER		1	/* Must have a valid username/password */
-#define AUTH_GROUP		2	/* Must also be in a named group */
-
-#define AUTH_ALLOW		0	/* Allow access */
-#define AUTH_DENY		1	/* Deny access */
-
-#define AUTH_NAME		0	/* Authorize host by name */
-#define AUTH_IP			1	/* Authorize host by IP */
-#define AUTH_INTERFACE		2	/* Authorize host by interface */
-
-#define AUTH_SATISFY_ALL	0	/* Satisfy both address and auth */
-#define AUTH_SATISFY_ANY	1	/* Satisfy either address or auth */
-
-#define AUTH_LIMIT_DELETE	1	/* Limit DELETE requests */
-#define AUTH_LIMIT_GET		2	/* Limit GET requests */
-#define AUTH_LIMIT_HEAD		4	/* Limit HEAD requests */
-#define AUTH_LIMIT_OPTIONS	8	/* Limit OPTIONS requests */
-#define AUTH_LIMIT_POST		16	/* Limit POST requests */
-#define AUTH_LIMIT_PUT		32	/* Limit PUT requests */
-#define AUTH_LIMIT_TRACE	64	/* Limit TRACE requests */
-#define AUTH_LIMIT_ALL		127	/* Limit all requests */
-#define AUTH_LIMIT_IPP		128	/* Limit IPP requests */
+#define CUPSD_AUTH_DEFAULT	-1	/* Use DefaultAuthType */
+#define CUPSD_AUTH_NONE		0	/* No authentication */
+#define CUPSD_AUTH_BASIC	1	/* Basic authentication */
+#define CUPSD_AUTH_DIGEST	2	/* Digest authentication */
+#define CUPSD_AUTH_BASICDIGEST	3	/* Basic authentication w/passwd.md5 */
+#define CUPSD_AUTH_NEGOTIATE	4	/* Kerberos authentication */
+
+#define CUPSD_AUTH_ANON		0	/* Anonymous access */
+#define CUPSD_AUTH_USER		1	/* Must have a valid username/password */
+#define CUPSD_AUTH_GROUP	2	/* Must also be in a named group */
+
+#define CUPSD_AUTH_ALLOW	0	/* Allow access */
+#define CUPSD_AUTH_DENY		1	/* Deny access */
+
+#define CUPSD_AUTH_NAME		0	/* Authorize host by name */
+#define CUPSD_AUTH_IP		1	/* Authorize host by IP */
+#define CUPSD_AUTH_INTERFACE	2	/* Authorize host by interface */
+
+#define CUPSD_AUTH_SATISFY_ALL	0	/* Satisfy both address and auth */
+#define CUPSD_AUTH_SATISFY_ANY	1	/* Satisfy either address or auth */
+
+#define CUPSD_AUTH_LIMIT_DELETE	1	/* Limit DELETE requests */
+#define CUPSD_AUTH_LIMIT_GET	2	/* Limit GET requests */
+#define CUPSD_AUTH_LIMIT_HEAD	4	/* Limit HEAD requests */
+#define CUPSD_AUTH_LIMIT_OPTIONS 8	/* Limit OPTIONS requests */
+#define CUPSD_AUTH_LIMIT_POST	16	/* Limit POST requests */
+#define CUPSD_AUTH_LIMIT_PUT	32	/* Limit PUT requests */
+#define CUPSD_AUTH_LIMIT_TRACE	64	/* Limit TRACE requests */
+#define CUPSD_AUTH_LIMIT_ALL	127	/* Limit all requests */
+#define CUPSD_AUTH_LIMIT_IPP	128	/* Limit IPP requests */
 
 #define IPP_ANY_OPERATION	(ipp_op_t)0
 					/* Any IPP operation */
@@ -116,7 +116,7 @@ typedef struct cupsd_client_s cupsd_clie
 
 VAR cups_array_t	*Locations	VALUE(NULL);
 					/* Authorization locations */
-VAR int			DefaultAuthType	VALUE(AUTH_BASIC);
+VAR int			DefaultAuthType	VALUE(CUPSD_AUTH_BASIC);
 					/* Default AuthType, if not specified */
 #ifdef HAVE_SSL
 VAR http_encryption_t	DefaultEncryption VALUE(HTTP_ENCRYPT_REQUIRED);
diff -up cups-1.3.5/scheduler/subscriptions.h.1.3.x cups-1.3.5/scheduler/subscriptions.h
--- cups-1.3.5/scheduler/subscriptions.h.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/scheduler/subscriptions.h	2008-02-14 13:03:30.000000000 +0000
@@ -20,47 +20,52 @@
 typedef enum
 {
   /* Individual printer events... */
-  CUPSD_EVENT_PRINTER_RESTARTED = 0x0001,
+  CUPSD_EVENT_PRINTER_STATE = 0x0001,	/* Sent after generic printer state change */
+  CUPSD_EVENT_PRINTER_RESTARTED = 0x0002,
 					/* Sent after printer restarted */
-  CUPSD_EVENT_PRINTER_SHUTDOWN = 0x0002,/* Sent after printer shutdown */
-  CUPSD_EVENT_PRINTER_STOPPED = 0x0004,	/* Sent after printer stopped */
-  CUPSD_EVENT_PRINTER_FINISHINGS_CHANGED = 0x0008,
+  CUPSD_EVENT_PRINTER_SHUTDOWN = 0x0004,/* Sent after printer shutdown */
+  CUPSD_EVENT_PRINTER_STOPPED = 0x0008,	/* Sent after printer stopped */
+
+  CUPSD_EVENT_PRINTER_CONFIG = 0x0010,	/* Send after add/modify changes attrs */
+  CUPSD_EVENT_PRINTER_FINISHINGS_CHANGED = 0x0020,
 					/* Sent after finishings-supported changed */
-  CUPSD_EVENT_PRINTER_MEDIA_CHANGED = 0x0010,
+  CUPSD_EVENT_PRINTER_MEDIA_CHANGED = 0x0040,
 					/* Sent after media-supported changed */
-  CUPSD_EVENT_PRINTER_ADDED = 0x0020,	/* Sent after printer added */
-  CUPSD_EVENT_PRINTER_DELETED = 0x0040,	/* Sent after printer deleted */
-  CUPSD_EVENT_PRINTER_MODIFIED = 0x0080,/* Sent after printer modified */
+  CUPSD_EVENT_PRINTER_ADDED = 0x0080,	/* Sent after printer added */
+  CUPSD_EVENT_PRINTER_DELETED = 0x0100,	/* Sent after printer deleted */
+  CUPSD_EVENT_PRINTER_MODIFIED = 0x0200,/* Sent after printer modified */
+  CUPSD_EVENT_PRINTER_QUEUE_ORDER_CHANGED = 0x0400,
+					/* Sent when the order of jobs is changed */
 
   /* Convenience printer event groupings... */
-  CUPSD_EVENT_PRINTER_STATE_CHANGED = 0x0007,
-					/* RESTARTED + SHUTDOWN + STOPPED */
-  CUPSD_EVENT_PRINTER_CONFIG_CHANGED = 0x0018,
-					/* FINISHINGS_CHANGED + MEDIA_CHANGED */
-  CUPSD_EVENT_PRINTER_CHANGED = 0x00ff,	/* All of the above */
+  CUPSD_EVENT_PRINTER_STATE_CHANGED = 0x000f,
+					/* STATE + RESTARTED + SHUTDOWN + STOPPED */
+  CUPSD_EVENT_PRINTER_CONFIG_CHANGED = 0x0070,
+					/* CONFIG + FINISHINGS_CHANGED + MEDIA_CHANGED */
+  CUPSD_EVENT_PRINTER_CHANGED = 0x07ff,	/* All of the above */
 
   /* Individual job events... */
-  CUPSD_EVENT_JOB_STATE = 0x0100,	/* Any state change */
-  CUPSD_EVENT_JOB_CREATED = 0x0200,	/* Send after job is created */
-  CUPSD_EVENT_JOB_COMPLETED = 0x0400,	/* Sent after job is completed */
-  CUPSD_EVENT_JOB_STOPPED = 0x0800,	/* Sent after job is stopped */
-  CUPSD_EVENT_JOB_CONFIG_CHANGED = 0x1000,
+  CUPSD_EVENT_JOB_STATE = 0x0800,	/* Any state change */
+  CUPSD_EVENT_JOB_CREATED = 0x1000,	/* Send after job is created */
+  CUPSD_EVENT_JOB_COMPLETED = 0x2000,	/* Sent after job is completed */
+  CUPSD_EVENT_JOB_STOPPED = 0x4000,	/* Sent after job is stopped */
+  CUPSD_EVENT_JOB_CONFIG_CHANGED = 0x8000,
 					/* Sent after set-job-attributes */
-  CUPSD_EVENT_JOB_PROGRESS = 0x2000,	/* Sent for each page */
+  CUPSD_EVENT_JOB_PROGRESS = 0x10000,	/* Sent for each page */
 
   /* Convenience job event grouping... */
-  CUPSD_EVENT_JOB_STATE_CHANGED = 0x0f00,
-					/* Any state change + CREATED + COMPLETED + STOPPED */
+  CUPSD_EVENT_JOB_STATE_CHANGED = 0x7800,
+					/* STATE + CREATED + COMPLETED + STOPPED */
 
   /* Server events... */
-  CUPSD_EVENT_SERVER_RESTARTED = 0x4000,/* Sent after server restarts */
-  CUPSD_EVENT_SERVER_STARTED = 0x8000,	/* Sent when server first starts */
-  CUPSD_EVENT_SERVER_STOPPED = 0x10000,	/* Sent when server is stopped */
-  CUPSD_EVENT_SERVER_AUDIT = 0x20000,	/* Security-related stuff */
+  CUPSD_EVENT_SERVER_RESTARTED = 0x20000,/* Sent after server restarts */
+  CUPSD_EVENT_SERVER_STARTED = 0x40000,	/* Sent when server first starts */
+  CUPSD_EVENT_SERVER_STOPPED = 0x80000,	/* Sent when server is stopped */
+  CUPSD_EVENT_SERVER_AUDIT = 0x100000,	/* Security-related stuff */
 
   /* Everything and nothing... */
   CUPSD_EVENT_NONE = 0,			/* Nothing */
-  CUPSD_EVENT_ALL = 0x1ffff		/* Everything */
+  CUPSD_EVENT_ALL = 0x1fffff		/* Everything */
 } cupsd_eventmask_t;
 
 
diff -up cups-1.3.5/scheduler/job.c.1.3.x cups-1.3.5/scheduler/job.c
--- cups-1.3.5/scheduler/job.c.1.3.x	2007-11-27 00:09:24.000000000 +0000
+++ cups-1.3.5/scheduler/job.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Job management routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -113,7 +113,8 @@ cupsdAddJob(int        priority,	/* I - 
   cupsd_job_t	*job;			/* New job record */
 
 
-  job = calloc(sizeof(cupsd_job_t), 1);
+  if ((job = calloc(sizeof(cupsd_job_t), 1)) == NULL)
+    return (NULL);
 
   job->id              = NextJobId ++;
   job->priority        = priority;
@@ -351,6 +352,7 @@ cupsdCheckJobs(void)
   cupsd_job_t		*job;		/* Current job in queue */
   cupsd_printer_t	*printer,	/* Printer destination */
 			*pclass;	/* Printer class destination */
+  ipp_attribute_t	*attr;		/* Job attribute */
 
 
   DEBUG_puts("cupsdCheckJobs()");
@@ -376,10 +378,25 @@ cupsdCheckJobs(void)
 	job->hold_until < time(NULL))
     {
       if (job->pending_timeout)
-        cupsdTimeoutJob(job);		/* Add trailing banner as needed */
+      {
+       /* Add trailing banner as needed */
+        if (cupsdTimeoutJob(job))
+	  continue;
+      }
 
       job->state->values[0].integer = IPP_JOB_PENDING;
       job->state_value              = IPP_JOB_PENDING;
+
+      if ((attr = ippFindAttribute(job->attrs, "job-hold-until",
+				   IPP_TAG_KEYWORD)) == NULL)
+	attr = ippFindAttribute(job->attrs, "job-hold-until", IPP_TAG_NAME);
+
+      if (attr)
+      {
+	attr->value_tag = IPP_TAG_KEYWORD;
+	cupsdSetString(&(attr->values[0].string.text), "no-hold");
+	cupsdSaveJob(job);
+      }
     }
 
    /*
@@ -439,9 +456,6 @@ cupsdCheckJobs(void)
 	  * so that we know which printer actually printed the job...
 	  */
 
-          ipp_attribute_t	*attr;	/* job-actual-printer-uri attribute */
-
-
           if ((attr = ippFindAttribute(job->attrs, "job-actual-printer-uri",
 	                               IPP_TAG_URI)) != NULL)
             cupsdSetString(&attr->values[0].string.text, printer->uri);
@@ -1812,6 +1826,7 @@ free_job(cupsd_job_t *job)		/* I - Job *
   cupsdClearString(&job->auth_username);
   cupsdClearString(&job->auth_domain);
   cupsdClearString(&job->auth_password);
+
 #ifdef HAVE_GSSAPI
  /*
   * Destroy the credential cache and clear the KRB5CCNAME env var string.
@@ -2445,7 +2460,7 @@ start_job(cupsd_job_t     *job,		/* I - 
 			title[IPP_MAX_NAME],
 					/* Job title string */
 			copies[255],	/* # copies string */
-			*envp[MAX_ENV + 15],
+			*envp[MAX_ENV + 16],
 					/* Environment variables */
 			charset[255],	/* CHARSET env variable */
 			class_name[255],/* CLASS env variable */
@@ -2458,6 +2473,10 @@ start_job(cupsd_job_t     *job,		/* I - 
 			final_content_type[1024],
 					/* FINAL_CONTENT_TYPE env variable */
 			lang[255],	/* LANG env variable */
+#ifdef __APPLE__
+			apple_language[255],
+					/* APPLE_LANGUAGE env variable */
+#endif /* __APPLE__ */
 			ppd[1024],	/* PPD env variable */
 			printer_name[255],
 					/* PRINTER env variable */
@@ -2514,7 +2533,7 @@ start_job(cupsd_job_t     *job,		/* I - 
                       "[Job %d] Unable to convert file %d to printable format!",
 	              job->current_file, job->id);
       cupsdLogMessage(CUPSD_LOG_INFO,
-                      "Hint: Do you have ESP Ghostscript installed?");
+                      "Hint: Do you have Ghostscript installed?");
 
       if (LogLevel < CUPSD_LOG_DEBUG)
         cupsdLogMessage(CUPSD_LOG_INFO,
@@ -2964,6 +2983,17 @@ start_job(cupsd_job_t     *job,		/* I - 
   else
     argv = calloc(8, sizeof(char *));
 
+  if (!argv)
+  {
+    cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to allocate argument array!");
+    cupsArrayDelete(filters);
+
+    FilterLevel -= job->cost;
+
+    cupsdStopPrinter(printer, 0);
+    return;
+  }
+
   sprintf(jobid, "%d", job->id);
 
   argv[0] = printer->name;
@@ -3000,6 +3030,12 @@ start_job(cupsd_job_t     *job,		/* I - 
   attr = ippFindAttribute(job->attrs, "attributes-natural-language",
                           IPP_TAG_LANGUAGE);
 
+#ifdef __APPLE__
+  strcpy(apple_language, "APPLE_LANGUAGE");
+  _cupsAppleLanguage(attr->values[0].string.text,
+		     apple_language + 15, sizeof(apple_language) - 15);
+#endif /* __APPLE__ */
+
   switch (strlen(attr->values[0].string.text))
   {
     default :
@@ -3060,6 +3096,9 @@ start_job(cupsd_job_t     *job,		/* I - 
 
   envp[envc ++] = charset;
   envp[envc ++] = lang;
+#ifdef __APPLE__
+  envp[envc ++] = apple_language;
+#endif /* __APPLE__ */
   envp[envc ++] = ppd;
   envp[envc ++] = rip_max_cache;
   envp[envc ++] = content_type;
@@ -3114,8 +3153,8 @@ start_job(cupsd_job_t     *job,		/* I - 
   envp[envc] = NULL;
 
   for (i = 0; i < envc; i ++)
-    if (!strncmp(envp[i], "AUTH_", 5))
-      cupsdLogMessage(CUPSD_LOG_DEBUG, "[Job %d] envp[%d]=\"AUTH_%c****\"",
+    if (!strncmp(envp[i], "CUPSD_AUTH_", 5))
+      cupsdLogMessage(CUPSD_LOG_DEBUG, "[Job %d] envp[%d]=\"CUPSD_AUTH_%c****\"",
                       job->id, i, envp[i][5]);
     else if (strncmp(envp[i], "DEVICE_URI=", 11))
       cupsdLogMessage(CUPSD_LOG_DEBUG, "[Job %d] envp[%d]=\"%s\"",
@@ -3321,7 +3360,7 @@ start_job(cupsd_job_t     *job,		/* I - 
 
   if (strncmp(printer->device_uri, "file:", 5) != 0)
   {
-    if (job->current_file == 1)
+    if (job->current_file == 1 || printer->remote)
     {
       sscanf(printer->device_uri, "%254[^:]", method);
       snprintf(command, sizeof(command), "%s/backend/%s", ServerBin, method);
@@ -3538,7 +3577,7 @@ update_job(cupsd_job_t *job)		/* I - Job
       * job sheet count...
       */
 
-      if (job->sheets != NULL)
+      if (job->sheets)
       {
         if (!strncasecmp(message, "total ", 6))
 	{
@@ -3583,8 +3622,9 @@ update_job(cupsd_job_t *job)		/* I - Job
 
       cupsdLogPage(job, message);
 
-      cupsdAddEvent(CUPSD_EVENT_JOB_PROGRESS, job->printer, job,
-                    "Printed %d page(s).", job->sheets->values[0].integer);
+      if (job->sheets)
+	cupsdAddEvent(CUPSD_EVENT_JOB_PROGRESS, job->printer, job,
+		      "Printed %d page(s).", job->sheets->values[0].integer);
     }
     else if (loglevel == CUPSD_LOG_STATE)
     {
@@ -3597,7 +3637,7 @@ update_job(cupsd_job_t *job)		/* I - Job
       {
 	cupsdSetPrinterReasons(job->printer, message);
 	cupsdAddPrinterHistory(job->printer);
-	event |= CUPSD_EVENT_PRINTER_STATE_CHANGED;
+	event |= CUPSD_EVENT_PRINTER_STATE;
       }
 
       update_job_attrs(job);
@@ -3626,14 +3666,42 @@ update_job(cupsd_job_t *job)		/* I - Job
       if ((attr = cupsGetOption("printer-alert", num_attrs, attrs)) != NULL)
       {
         cupsdSetString(&job->printer->alert, attr);
-	event |= CUPSD_EVENT_PRINTER_STATE_CHANGED;
+	event |= CUPSD_EVENT_PRINTER_STATE;
       }
 
       if ((attr = cupsGetOption("printer-alert-description", num_attrs,
                                 attrs)) != NULL)
       {
         cupsdSetString(&job->printer->alert_description, attr);
-	event |= CUPSD_EVENT_PRINTER_STATE_CHANGED;
+	event |= CUPSD_EVENT_PRINTER_STATE;
+      }
+
+      if ((attr = cupsGetOption("marker-colors", num_attrs, attrs)) != NULL)
+      {
+        cupsdSetPrinterAttr(job->printer, "marker-colors", (char *)attr);
+	job->printer->marker_time = time(NULL);
+	event |= CUPSD_EVENT_PRINTER_STATE;
+      }
+
+      if ((attr = cupsGetOption("marker-levels", num_attrs, attrs)) != NULL)
+      {
+        cupsdSetPrinterAttr(job->printer, "marker-levels", (char *)attr);
+	job->printer->marker_time = time(NULL);
+	event |= CUPSD_EVENT_PRINTER_STATE;
+      }
+
+      if ((attr = cupsGetOption("marker-names", num_attrs, attrs)) != NULL)
+      {
+        cupsdSetPrinterAttr(job->printer, "marker-names", (char *)attr);
+	job->printer->marker_time = time(NULL);
+	event |= CUPSD_EVENT_PRINTER_STATE;
+      }
+
+      if ((attr = cupsGetOption("marker-types", num_attrs, attrs)) != NULL)
+      {
+        cupsdSetPrinterAttr(job->printer, "marker-types", (char *)attr);
+	job->printer->marker_time = time(NULL);
+	event |= CUPSD_EVENT_PRINTER_STATE;
       }
 
       cupsFreeOptions(num_attrs, attrs);
@@ -3650,7 +3718,7 @@ update_job(cupsd_job_t *job)		/* I - Job
 
       cupsdSetString(&job->printer->recoverable, ptr);
       cupsdAddPrinterHistory(job->printer);
-      event |= CUPSD_EVENT_PRINTER_STATE_CHANGED;
+      event |= CUPSD_EVENT_PRINTER_STATE;
     }
     else if (!strncmp(message, "recovered:", 10))
     {
@@ -3663,7 +3731,7 @@ update_job(cupsd_job_t *job)		/* I - Job
 
       cupsdSetString(&job->printer->recoverable, ptr);
       cupsdAddPrinterHistory(job->printer);
-      event |= CUPSD_EVENT_PRINTER_STATE_CHANGED;
+      event |= CUPSD_EVENT_PRINTER_STATE;
     }
 #endif /* __APPLE__ */
     else if (loglevel <= job->status_level)
@@ -3678,7 +3746,7 @@ update_job(cupsd_job_t *job)		/* I - Job
       strlcpy(job->printer->state_message, message,
               sizeof(job->printer->state_message));
       cupsdAddPrinterHistory(job->printer);
-      event |= CUPSD_EVENT_PRINTER_STATE_CHANGED;
+      event |= CUPSD_EVENT_PRINTER_STATE;
 
       update_job_attrs(job);
     }
@@ -3687,8 +3755,8 @@ update_job(cupsd_job_t *job)		/* I - Job
       break;
   }
 
-  if ((event & CUPSD_EVENT_PRINTER_STATE_CHANGED))
-    cupsdAddEvent(CUPSD_EVENT_PRINTER_STATE_CHANGED, job->printer, NULL,
+  if (event & CUPSD_EVENT_PRINTER_STATE)
+    cupsdAddEvent(CUPSD_EVENT_PRINTER_STATE, job->printer, NULL,
 		  (job->printer->type & CUPS_PRINTER_CLASS) ?
 		      "Class \"%s\" state changed." :
 		      "Printer \"%s\" state changed.",
diff -up cups-1.3.5/scheduler/type.c.1.3.x cups-1.3.5/scheduler/type.c
--- cups-1.3.5/scheduler/type.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/scheduler/type.c	2008-02-14 13:03:30.000000000 +0000
@@ -567,12 +567,12 @@ mimeFileType(mime_t     *mime,		/* I - M
     if ((base = strrchr(filename, '/')) != NULL)
       base ++;
     else
-      filename = filename;
+      base = filename;
   }
   else if ((base = strrchr(pathname, '/')) != NULL)
     base ++;
   else
-    filename = pathname;
+    base = pathname;
 
  /*
   * Then check it against all known types...
@@ -638,8 +638,8 @@ compare_types(mime_type_t *t0,		/* I - F
   int	i;				/* Result of comparison */
 
 
-  if ((i = strcmp(t0->super, t1->super)) == 0)
-    i = strcmp(t0->type, t1->type);
+  if ((i = strcasecmp(t0->super, t1->super)) == 0)
+    i = strcasecmp(t0->type, t1->type);
 
   return (i);
 }
diff -up cups-1.3.5/scheduler/subscriptions.c.1.3.x cups-1.3.5/scheduler/subscriptions.c
--- cups-1.3.5/scheduler/subscriptions.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/scheduler/subscriptions.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Subscription routines for the Common UNIX Printing System (CUPS) scheduler.
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -323,7 +323,7 @@ cupsdAddSubscription(
                   "cupsdAddSubscription(mask=%x, dest=%p(%s), job=%p(%d), "
 		  "uri=\"%s\")",
                   mask, dest, dest ? dest->name : "", job, job ? job->id : 0,
-		  uri);
+		  uri ? uri : "(null)");
 
   if (!Subscriptions)
     Subscriptions = cupsArrayNew((cups_array_func_t)cupsd_compare_subscriptions,
@@ -504,9 +504,14 @@ cupsdEventName(
     case CUPSD_EVENT_PRINTER_MODIFIED :
         return ("printer-modified");
 
+    case CUPSD_EVENT_PRINTER_QUEUE_ORDER_CHANGED :
+        return ("printer-queue-order-changed");
+
+    case CUPSD_EVENT_PRINTER_STATE :
     case CUPSD_EVENT_PRINTER_STATE_CHANGED :
         return ("printer-state-changed");
 
+    case CUPSD_EVENT_PRINTER_CONFIG :
     case CUPSD_EVENT_PRINTER_CONFIG_CHANGED :
         return ("printer-config-changed");
 
@@ -529,8 +534,6 @@ cupsdEventName(
         return ("job-progress");
 
     case CUPSD_EVENT_JOB_STATE :
-        return ("job-state");
-
     case CUPSD_EVENT_JOB_STATE_CHANGED :
         return ("job-state-changed");
 
@@ -577,14 +580,14 @@ cupsdEventValue(const char *name)	/* I -
     return (CUPSD_EVENT_PRINTER_DELETED);
   else if (!strcmp(name, "printer-modified"))
     return (CUPSD_EVENT_PRINTER_MODIFIED);
+  else if (!strcmp(name, "printer-queue-order-changed"))
+    return (CUPSD_EVENT_PRINTER_QUEUE_ORDER_CHANGED);
   else if (!strcmp(name, "printer-state-changed"))
     return (CUPSD_EVENT_PRINTER_STATE_CHANGED);
   else if (!strcmp(name, "printer-config-changed"))
     return (CUPSD_EVENT_PRINTER_CONFIG_CHANGED);
   else if (!strcmp(name, "printer-changed"))
     return (CUPSD_EVENT_PRINTER_CHANGED);
-  else if (!strcmp(name, "job-state"))
-    return (CUPSD_EVENT_JOB_STATE);
   else if (!strcmp(name, "job-created"))
     return (CUPSD_EVENT_JOB_CREATED);
   else if (!strcmp(name, "job-completed"))
@@ -731,7 +734,7 @@ cupsdLoadAllSubscriptions(void)
         cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of subscriptions.conf.",
 	                linenum);
-        return;
+        break;
       }
     }
     else if (!strcasecmp(line, "</Subscription>"))
@@ -741,7 +744,7 @@ cupsdLoadAllSubscriptions(void)
         cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of subscriptions.conf.",
 	                linenum);
-        return;
+        break;
       }
 
       if (delete_sub)
@@ -755,7 +758,7 @@ cupsdLoadAllSubscriptions(void)
       cupsdLogMessage(CUPSD_LOG_ERROR,
                       "Syntax error on line %d of subscriptions.conf.",
 	              linenum);
-      return;
+      break;
     }
     else if (!strcasecmp(line, "Events"))
     {
@@ -769,7 +772,7 @@ cupsdLoadAllSubscriptions(void)
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of subscriptions.conf.",
 	                linenum);
-	return;
+	break;
       }
 
       while (*value)
@@ -792,7 +795,7 @@ cupsdLoadAllSubscriptions(void)
 	  cupsdLogMessage(CUPSD_LOG_ERROR,
 	                  "Unknown event name \'%s\' on line %d of subscriptions.conf.",
 	                  value, linenum);
-	  return;
+	  break;
 	}
 
 	value = valueptr;
@@ -811,7 +814,7 @@ cupsdLoadAllSubscriptions(void)
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of subscriptions.conf.",
 	                linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "Recipient"))
@@ -827,7 +830,7 @@ cupsdLoadAllSubscriptions(void)
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of subscriptions.conf.",
 	                linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "JobId"))
@@ -851,7 +854,7 @@ cupsdLoadAllSubscriptions(void)
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of subscriptions.conf.",
 	                linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "PrinterName"))
@@ -875,7 +878,7 @@ cupsdLoadAllSubscriptions(void)
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of subscriptions.conf.",
 	                linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "UserData"))
@@ -937,7 +940,7 @@ cupsdLoadAllSubscriptions(void)
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of subscriptions.conf.",
 	                linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "LeaseDuration"))
@@ -956,7 +959,7 @@ cupsdLoadAllSubscriptions(void)
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of subscriptions.conf.",
 	                linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "Interval"))
@@ -972,7 +975,7 @@ cupsdLoadAllSubscriptions(void)
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of subscriptions.conf.",
 	                linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "ExpirationTime"))
@@ -988,7 +991,7 @@ cupsdLoadAllSubscriptions(void)
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of subscriptions.conf.",
 	                linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "NextEventId"))
@@ -1004,7 +1007,7 @@ cupsdLoadAllSubscriptions(void)
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of subscriptions.conf.",
 	                linenum);
-	return;
+	break;
       }
     }
     else
diff -up cups-1.3.5/scheduler/ipp.c.1.3.x cups-1.3.5/scheduler/ipp.c
--- cups-1.3.5/scheduler/ipp.c.1.3.x	2007-12-15 00:23:16.000000000 +0000
+++ cups-1.3.5/scheduler/ipp.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   IPP routines for the Common UNIX Printing System (CUPS) scheduler.
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  *   This file contains Kerberos support code, copyright 2006 by
@@ -658,7 +658,7 @@ cupsdProcessIPPRequest(
                     con->http.fd, con->response->request.status.status_code,
 	            ippErrorString(con->response->request.status.status_code));
 
-    if (cupsdSendHeader(con, HTTP_OK, "application/ipp", AUTH_NONE))
+    if (cupsdSendHeader(con, HTTP_OK, "application/ipp", CUPSD_AUTH_NONE))
     {
 #ifdef CUPSD_USE_CHUNKING
      /*
@@ -746,7 +746,7 @@ cupsdProcessIPPRequest(
  * 'cupsdTimeoutJob()' - Timeout a job waiting on job files.
  */
 
-void
+int					/* O - 0 on success, -1 on error */
 cupsdTimeoutJob(cupsd_job_t *job)	/* I - Job to timeout */
 {
   cupsd_printer_t	*printer;	/* Destination printer or class */
@@ -774,10 +774,13 @@ cupsdTimeoutJob(cupsd_job_t *job)	/* I -
     cupsdLogMessage(CUPSD_LOG_INFO, "[Job %d] Adding end banner page \"%s\".",
                     job->id, attr->values[1].string.text);
 
-    kbytes = copy_banner(NULL, job, attr->values[1].string.text);
+    if ((kbytes = copy_banner(NULL, job, attr->values[1].string.text)) < 0)
+      return (-1);
 
     cupsdUpdateQuota(printer, job->username, 0, kbytes);
   }
+
+  return (0);
 }
 
 
@@ -1786,7 +1789,8 @@ add_job(cupsd_client_t  *con,		/* I - Cl
                       "[Job %d] Adding start banner page \"%s\".",
                       job->id, attr->values[0].string.text);
 
-      kbytes = copy_banner(con, job, attr->values[0].string.text);
+      if ((kbytes = copy_banner(con, job, attr->values[0].string.text)) < 0)
+        return (NULL);
 
       cupsdUpdateQuota(printer, job->username, 0, kbytes);
     }
@@ -2403,12 +2407,15 @@ add_printer(cupsd_client_t  *con,	/* I -
 
     supported = ippFindAttribute(printer->attrs, "port-monitor-supported",
                                  IPP_TAG_NAME);
-    for (i = 0; i < supported->num_values; i ++)
-      if (!strcmp(supported->values[i].string.text,
-                  attr->values[0].string.text))
-        break;
+    if (supported)
+    {
+      for (i = 0; i < supported->num_values; i ++)
+        if (!strcmp(supported->values[i].string.text,
+                    attr->values[0].string.text))
+          break;
+    }
 
-    if (i >= supported->num_values)
+    if (!supported || i >= supported->num_values)
     {
       send_ipp_status(con, IPP_NOT_POSSIBLE, _("Bad port-monitor \"%s\"!"),
         	      attr->values[0].string.text);
@@ -3410,13 +3417,6 @@ check_quotas(cupsd_client_t  *con,	/* I 
                   con, con->http.fd, p, p->name);
 
  /*
-  * Check input...
-  */
-
-  if (!con || !p)
-    return (0);
-
- /*
   * Figure out who is printing...
   */
 
@@ -3922,7 +3922,7 @@ copy_banner(cupsd_client_t *con,	/* I - 
   */
 
   if (add_file(con, job, banner->filetype, 0))
-    return (0);
+    return (-1);
 
   snprintf(filename, sizeof(filename), "%s/d%05d-%03d", RequestRoot, job->id,
            job->num_files);
@@ -4644,6 +4644,10 @@ copy_printer_attrs(
 		 printer->recoverable);
 #endif /* __APPLE__ */
 
+  if (!ra || cupsArrayFind(ra, "marker-change-time"))
+    ippAddInteger(con->response, IPP_TAG_PRINTER, IPP_TAG_INTEGER,
+                  "marker-change-time", printer->marker_time);
+
   if (printer->alert && (!ra || cupsArrayFind(ra, "printer-alert")))
     ippAddString(con->response, IPP_TAG_PRINTER, IPP_TAG_STRING,
                  "printer-alert", NULL, printer->alert);
@@ -7036,17 +7040,6 @@ move_job(cupsd_client_t  *con,		/* I - C
   }
 
  /*
-  * Check policy...
-  */
-
-  if ((status = cupsdCheckPolicy(dprinter->op_policy_ptr, con,
-                                 NULL)) != HTTP_OK)
-  {
-    send_http_error(con, status, dprinter);
-    return;
-  }
-
- /*
   * See if we have a job URI or a printer URI...
   */
 
@@ -7154,6 +7147,17 @@ move_job(cupsd_client_t  *con,		/* I - C
   }
 
  /*
+  * Check the policy of the destination printer...
+  */
+
+  if ((status = cupsdCheckPolicy(dprinter->op_policy_ptr, con,
+                                 job ? job->username : NULL)) != HTTP_OK)
+  {
+    send_http_error(con, status, dprinter);
+    return;
+  }
+
+ /*
   * Now move the job or jobs...
   */
 
@@ -7541,7 +7545,8 @@ print_job(cupsd_client_t  *con,		/* I - 
   * See if we need to add the ending sheet...
   */
 
-  cupsdTimeoutJob(job);
+  if (cupsdTimeoutJob(job))
+    return;
 
  /*
   * Log and save the job...
@@ -8265,13 +8270,13 @@ save_auth_info(
       cupsFilePrintf(fp, "%s\n", line);
 
       if (!strcmp(dest->auth_info_required[i], "username"))
-        cupsdSetStringf(&job->auth_username, "AUTH_USERNAME=%s",
+        cupsdSetStringf(&job->auth_username, "CUPSD_AUTH_USERNAME=%s",
 	                auth_info->values[i].string.text);
       else if (!strcmp(dest->auth_info_required[i], "domain"))
-        cupsdSetStringf(&job->auth_domain, "AUTH_DOMAIN=%s",
+        cupsdSetStringf(&job->auth_domain, "CUPSD_AUTH_DOMAIN=%s",
 	                auth_info->values[i].string.text);
       else if (!strcmp(dest->auth_info_required[i], "password"))
-        cupsdSetStringf(&job->auth_password, "AUTH_PASSWORD=%s",
+        cupsdSetStringf(&job->auth_password, "CUPSD_AUTH_PASSWORD=%s",
 	                auth_info->values[i].string.text);
     }
   }
@@ -8284,7 +8289,7 @@ save_auth_info(
     httpEncode64_2(line, sizeof(line), con->username, strlen(con->username));
     cupsFilePrintf(fp, "%s\n", line);
 
-    cupsdSetStringf(&job->auth_username, "AUTH_USERNAME=%s", con->username);
+    cupsdSetStringf(&job->auth_username, "CUPSD_AUTH_USERNAME=%s", con->username);
     cupsdClearString(&job->auth_domain);
 
    /*
@@ -8294,7 +8299,7 @@ save_auth_info(
     httpEncode64_2(line, sizeof(line), con->password, strlen(con->password));
     cupsFilePrintf(fp, "%s\n", line);
 
-    cupsdSetStringf(&job->auth_password, "AUTH_PASSWORD=%s", con->password);
+    cupsdSetStringf(&job->auth_password, "CUPSD_AUTH_PASSWORD=%s", con->password);
   }
 
  /*
@@ -8745,7 +8750,8 @@ send_document(cupsd_client_t  *con,	/* I
     * See if we need to add the ending sheet...
     */
 
-    cupsdTimeoutJob(job);
+    if (cupsdTimeoutJob(job))
+      return;
 
     if (job->state_value == IPP_JOB_STOPPED)
     {
@@ -8830,7 +8836,7 @@ send_http_error(
   if (status == HTTP_UNAUTHORIZED &&
       printer && printer->num_auth_info_required > 0 &&
       !strcmp(printer->auth_info_required[0], "negotiate"))
-    cupsdSendError(con, status, AUTH_NEGOTIATE);
+    cupsdSendError(con, status, CUPSD_AUTH_NEGOTIATE);
   else if (printer)
   {
     char	resource[HTTP_MAX_URI];	/* Resource portion of URI */
@@ -8843,13 +8849,13 @@ send_http_error(
       snprintf(resource, sizeof(resource), "/printers/%s", printer->name);
 
     if ((auth = cupsdFindBest(resource, HTTP_POST)) == NULL ||
-        auth->type == AUTH_NONE)
+        auth->type == CUPSD_AUTH_NONE)
       auth = cupsdFindPolicyOp(printer->op_policy_ptr, IPP_PRINT_JOB);
 
-    cupsdSendError(con, status, auth ? auth->type : AUTH_NONE);
+    cupsdSendError(con, status, auth ? auth->type : CUPSD_AUTH_NONE);
   }
   else
-    cupsdSendError(con, status, AUTH_NONE);
+    cupsdSendError(con, status, CUPSD_AUTH_NONE);
 
   ippDelete(con->response);
   con->response = NULL;
@@ -9152,7 +9158,8 @@ set_job_attrs(cupsd_client_t  *con,	/* I
       else if (con->response->request.status.status_code == IPP_OK)
       {
         cupsdSetJobPriority(job, attr->values[0].integer);
-        event |= CUPSD_EVENT_JOB_CONFIG_CHANGED;
+        event |= CUPSD_EVENT_JOB_CONFIG_CHANGED |
+	         CUPSD_EVENT_PRINTER_QUEUE_ORDER_CHANGED;
       }
     }
     else if (!strcmp(attr->name, "job-state"))
@@ -9299,6 +9306,10 @@ set_job_attrs(cupsd_client_t  *con,	/* I
   * Send events as needed...
   */
 
+  if (event & CUPSD_EVENT_PRINTER_QUEUE_ORDER_CHANGED)
+    cupsdAddEvent(CUPSD_EVENT_PRINTER_QUEUE_ORDER_CHANGED, job->printer, job,
+                  "Job priority changed by user.");
+
   if (event & CUPSD_EVENT_JOB_STATE)
     cupsdAddEvent(CUPSD_EVENT_JOB_STATE, job->printer, job,
                   job->state_value == IPP_JOB_HELD ?
@@ -9805,6 +9816,8 @@ user_allowed(cupsd_printer_t *p,	/* I - 
 {
   int		i;			/* Looping var */
   struct passwd	*pw;			/* User password data */
+  char		baseuser[256],		/* Base username */
+		*baseptr;		/* Pointer to "@" in base username */
 
 
   if (p->num_users == 0)
@@ -9813,6 +9826,20 @@ user_allowed(cupsd_printer_t *p,	/* I - 
   if (!strcmp(username, "root"))
     return (1);
 
+  if (strchr(username, '@'))
+  {
+   /*
+    * Strip @REALM for username check...
+    */
+
+    strlcpy(baseuser, username, sizeof(baseuser));
+
+    if ((baseptr = strchr(baseuser, '@')) != NULL)
+      *baseptr = '\0';
+
+    username = baseuser;
+  }
+
   pw = getpwnam(username);
   endpwent();
 
@@ -9979,8 +10006,8 @@ validate_user(cupsd_job_t    *job,	/* I 
   cupsdLogMessage(CUPSD_LOG_DEBUG2,
                   "validate_user(job=%d, con=%d, owner=\"%s\", username=%p, "
 		  "userlen=%d)",
-        	  job ? job->id : 0, con->http.fd, owner ? owner : "(null)",
-		  username, userlen);
+        	  job->id, con ? con->http.fd : 0,
+		  owner ? owner : "(null)", username, userlen);
 
  /*
   * Validate input...
diff -up cups-1.3.5/scheduler/dirsvc.c.1.3.x cups-1.3.5/scheduler/dirsvc.c
--- cups-1.3.5/scheduler/dirsvc.c.1.3.x	2007-12-06 20:44:04.000000000 +0000
+++ cups-1.3.5/scheduler/dirsvc.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Directory services routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -325,7 +325,7 @@ cupsdLoadRemoteCache(void)
       {
         cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of remote.cache.", linenum);
-        return;
+        break;
       }
     }
     else if (!strcasecmp(line, "<Class") ||
@@ -366,7 +366,7 @@ cupsdLoadRemoteCache(void)
       {
         cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of remote.cache.", linenum);
-        return;
+        break;
       }
     }
     else if (!strcasecmp(line, "</Printer>") ||
@@ -386,14 +386,14 @@ cupsdLoadRemoteCache(void)
       {
         cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of remote.cache.", linenum);
-        return;
+        break;
       }
     }
     else if (!p)
     {
       cupsdLogMessage(CUPSD_LOG_ERROR,
                       "Syntax error on line %d of remote.cache.", linenum);
-      return;
+      break;
     }
     else if (!strcasecmp(line, "Info"))
     {
@@ -426,7 +426,7 @@ cupsdLoadRemoteCache(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of remote.cache.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "Option") && value)
@@ -462,7 +462,7 @@ cupsdLoadRemoteCache(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of remote.cache.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "StateMessage"))
@@ -494,7 +494,7 @@ cupsdLoadRemoteCache(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of remote.cache.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "Type"))
@@ -505,7 +505,7 @@ cupsdLoadRemoteCache(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of remote.cache.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "BrowseTime"))
@@ -521,7 +521,7 @@ cupsdLoadRemoteCache(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of remote.cache.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "JobSheets"))
@@ -556,7 +556,7 @@ cupsdLoadRemoteCache(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of remote.cache.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "AllowUser"))
@@ -570,7 +570,7 @@ cupsdLoadRemoteCache(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of remote.cache.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "DenyUser"))
@@ -584,7 +584,7 @@ cupsdLoadRemoteCache(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of remote.cache.", linenum);
-	return;
+	break;
       }
     }
     else
@@ -1793,9 +1793,9 @@ process_browse_data(
     if (hptr && !*hptr)
       *hptr = '.';			/* Resource FQDN */
 
-    if ((p = cupsdFindClass(name)) == NULL && BrowseShortNames)
+    if ((p = cupsdFindDest(name)) == NULL && BrowseShortNames)
     {
-      if ((p = cupsdFindClass(resource + 9)) != NULL)
+      if ((p = cupsdFindDest(resource + 9)) != NULL)
       {
         if (p->hostname && strcasecmp(p->hostname, host))
 	{
@@ -1900,9 +1900,9 @@ process_browse_data(
     if (hptr && !*hptr)
       *hptr = '.';			/* Resource FQDN */
 
-    if ((p = cupsdFindPrinter(name)) == NULL && BrowseShortNames)
+    if ((p = cupsdFindDest(name)) == NULL && BrowseShortNames)
     {
-      if ((p = cupsdFindPrinter(resource + 10)) != NULL)
+      if ((p = cupsdFindDest(resource + 10)) != NULL)
       {
         if (p->hostname && strcasecmp(p->hostname, host))
 	{
@@ -3629,7 +3629,7 @@ update_cups_browse(void)
       * Access from localhost (127.0.0.1) is always allowed...
       */
 
-      auth = AUTH_ALLOW;
+      auth = CUPSD_AUTH_ALLOW;
     }
     else
     {
@@ -3640,39 +3640,39 @@ update_cups_browse(void)
       switch (BrowseACL->order_type)
       {
         default :
-	    auth = AUTH_DENY;	/* anti-compiler-warning-code */
+	    auth = CUPSD_AUTH_DENY;	/* anti-compiler-warning-code */
 	    break;
 
-	case AUTH_ALLOW : /* Order Deny,Allow */
-            auth = AUTH_ALLOW;
+	case CUPSD_AUTH_ALLOW : /* Order Deny,Allow */
+            auth = CUPSD_AUTH_ALLOW;
 
             if (cupsdCheckAuth(address, srcname, len,
 	        	  BrowseACL->num_deny, BrowseACL->deny))
-	      auth = AUTH_DENY;
+	      auth = CUPSD_AUTH_DENY;
 
             if (cupsdCheckAuth(address, srcname, len,
 	        	  BrowseACL->num_allow, BrowseACL->allow))
-	      auth = AUTH_ALLOW;
+	      auth = CUPSD_AUTH_ALLOW;
 	    break;
 
-	case AUTH_DENY : /* Order Allow,Deny */
-            auth = AUTH_DENY;
+	case CUPSD_AUTH_DENY : /* Order Allow,Deny */
+            auth = CUPSD_AUTH_DENY;
 
             if (cupsdCheckAuth(address, srcname, len,
 	        	  BrowseACL->num_allow, BrowseACL->allow))
-	      auth = AUTH_ALLOW;
+	      auth = CUPSD_AUTH_ALLOW;
 
             if (cupsdCheckAuth(address, srcname, len,
 	        	  BrowseACL->num_deny, BrowseACL->deny))
-	      auth = AUTH_DENY;
+	      auth = CUPSD_AUTH_DENY;
 	    break;
       }
     }
   }
   else
-    auth = AUTH_ALLOW;
+    auth = CUPSD_AUTH_ALLOW;
 
-  if (auth == AUTH_DENY)
+  if (auth == CUPSD_AUTH_DENY)
   {
     cupsdLogMessage(CUPSD_LOG_DEBUG,
                     "update_cups_browse: Refused %d bytes from %s", bytes,
diff -up cups-1.3.5/scheduler/printers.c.1.3.x cups-1.3.5/scheduler/printers.c
--- cups-1.3.5/scheduler/printers.c.1.3.x	2007-12-11 00:37:08.000000000 +0000
+++ cups-1.3.5/scheduler/printers.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Printer routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -27,6 +27,7 @@
  *   cupsdSaveAllPrinters()      - Save all printer definitions to the
  *                                 printers.conf file.
  *   cupsdSetAuthInfoRequired()  - Set the required authentication info.
+ *   cupsdSetPrinterAttr()       - Set a printer attribute.
  *   cupsdSetPrinterAttrs()      - Set printer attributes based upon the PPD
  *                                 file.
  *   cupsdSetPrinterReasons()    - Set/update the reasons strings.
@@ -900,7 +901,7 @@ cupsdLoadAllPrinters(void)
       {
         cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of printers.conf.", linenum);
-        return;
+	break;
       }
     }
     else if (!strcasecmp(line, "</Printer>"))
@@ -945,14 +946,14 @@ cupsdLoadAllPrinters(void)
       {
         cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of printers.conf.", linenum);
-        return;
+	break;
       }
     }
     else if (!p)
     {
       cupsdLogMessage(CUPSD_LOG_ERROR,
                       "Syntax error on line %d of printers.conf.", linenum);
-      return;
+      break;
     }
     else if (!strcasecmp(line, "AuthInfoRequired"))
     {
@@ -979,7 +980,7 @@ cupsdLoadAllPrinters(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of printers.conf.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "Option") && value)
@@ -1011,7 +1012,7 @@ cupsdLoadAllPrinters(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of printers.conf.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "State"))
@@ -1028,7 +1029,7 @@ cupsdLoadAllPrinters(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of printers.conf.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "StateMessage"))
@@ -1069,7 +1070,7 @@ cupsdLoadAllPrinters(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of printers.conf.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "Shared"))
@@ -1092,7 +1093,7 @@ cupsdLoadAllPrinters(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of printers.conf.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "JobSheets"))
@@ -1127,7 +1128,7 @@ cupsdLoadAllPrinters(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of printers.conf.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "AllowUser"))
@@ -1141,7 +1142,7 @@ cupsdLoadAllPrinters(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of printers.conf.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "DenyUser"))
@@ -1155,7 +1156,7 @@ cupsdLoadAllPrinters(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of printers.conf.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "QuotaPeriod"))
@@ -1166,7 +1167,7 @@ cupsdLoadAllPrinters(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of printers.conf.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "PageLimit"))
@@ -1177,7 +1178,7 @@ cupsdLoadAllPrinters(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of printers.conf.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "KLimit"))
@@ -1188,7 +1189,7 @@ cupsdLoadAllPrinters(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of printers.conf.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "OpPolicy"))
@@ -1212,7 +1213,7 @@ cupsdLoadAllPrinters(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of printers.conf.", linenum);
-	return;
+	break;
       }
     }
     else if (!strcasecmp(line, "ErrorPolicy"))
@@ -1223,7 +1224,7 @@ cupsdLoadAllPrinters(void)
       {
 	cupsdLogMessage(CUPSD_LOG_ERROR,
 	                "Syntax error on line %d of printers.conf.", linenum);
-	return;
+	break;
       }
     }
     else
@@ -1642,6 +1643,120 @@ cupsdSetAuthInfoRequired(
 
 
 /*
+ * 'cupsdSetPrinterAttr()' - Set a printer attribute.
+ */
+
+void
+cupsdSetPrinterAttr(
+    cupsd_printer_t *p,			/* I - Printer */
+    const char      *name,		/* I - Attribute name */
+    char            *value)		/* I - Attribute value string */
+{
+  ipp_attribute_t	*attr;		/* Attribute */
+  int			i,		/* Looping var */
+			count;		/* Number of values */
+  char			*ptr;		/* Pointer into value */
+  ipp_tag_t		value_tag;	/* Value tag for this attribute */
+
+
+ /*
+  * Count the number of values...
+  */
+
+  for (count = 1, ptr = value;
+       (ptr = strchr(ptr, ',')) != NULL;
+       ptr ++, count ++);
+
+ /*
+  * Then add or update the attribute as needed...
+  */
+
+  if (!strcmp(name, "marker-levels"))
+  {
+   /*
+    * Integer values...
+    */
+
+    if ((attr = ippFindAttribute(p->attrs, name, IPP_TAG_INTEGER)) != NULL &&
+        attr->num_values < count)
+    {
+      ippDeleteAttribute(p->attrs, attr);
+      attr = NULL;
+    }
+
+    if (attr)
+      attr->num_values = count;
+    else
+      attr = ippAddIntegers(p->attrs, IPP_TAG_PRINTER, IPP_TAG_INTEGER, name,
+                            count, NULL);
+
+    if (!attr)
+    {
+      cupsdLogMessage(CUPSD_LOG_ERROR,
+                      "Unable to allocate memory for printer attribute "
+		      "(%d values)", count);
+      return;
+    }
+
+    for (i = 0; i < count; i ++)
+    {
+      if ((ptr = strchr(value, ',')) != NULL)
+        *ptr++ = '\0';
+
+      attr->values[i].integer = strtol(value, NULL, 10);
+
+      if (ptr)
+        value = ptr;
+    }
+  }
+  else
+  {
+   /*
+    * Name or keyword values...
+    */
+
+    if (!strcmp(name, "marker-types"))
+      value_tag = IPP_TAG_KEYWORD;
+    else
+      value_tag = IPP_TAG_NAME;
+
+    if ((attr = ippFindAttribute(p->attrs, name, value_tag)) != NULL &&
+        attr->num_values < count)
+    {
+      ippDeleteAttribute(p->attrs, attr);
+      attr = NULL;
+    }
+
+    if (attr)
+      attr->num_values = count;
+    else
+      attr = ippAddStrings(p->attrs, IPP_TAG_PRINTER, value_tag, name,
+                           count, NULL, NULL);
+
+    if (!attr)
+    {
+      cupsdLogMessage(CUPSD_LOG_ERROR,
+                      "Unable to allocate memory for printer attribute "
+		      "(%d values)", count);
+      return;
+    }
+
+    for (i = 0; i < count; i ++)
+    {
+      if ((ptr = strchr(value, ',')) != NULL)
+        *ptr++ = '\0';
+
+      _cupsStrFree(attr->values[i].string.text);
+      attr->values[i].string.text = _cupsStrAlloc(value);
+
+      if (ptr)
+        value = ptr;
+    }
+  }
+}
+
+
+/*
  * 'cupsdSetPrinterAttrs()' - Set printer attributes based upon the PPD file.
  */
 
@@ -1736,25 +1851,25 @@ cupsdSetPrinterAttrs(cupsd_printer_t *p)
       snprintf(resource, sizeof(resource), "/printers/%s", p->name);
 
     if ((auth = cupsdFindBest(resource, HTTP_POST)) == NULL ||
-        auth->type == AUTH_NONE)
+        auth->type == CUPSD_AUTH_NONE)
       auth = cupsdFindPolicyOp(p->op_policy_ptr, IPP_PRINT_JOB);
 
     if (auth)
     {
-      if (auth->type == AUTH_BASIC || auth->type == AUTH_BASICDIGEST)
+      if (auth->type == CUPSD_AUTH_BASIC || auth->type == CUPSD_AUTH_BASICDIGEST)
       {
 	auth_supported = "basic";
 	num_air        = 2;
 	air            = air_userpass;
       }
-      else if (auth->type == AUTH_DIGEST)
+      else if (auth->type == CUPSD_AUTH_DIGEST)
       {
 	auth_supported = "digest";
 	num_air        = 2;
 	air            = air_userpass;
       }
 #ifdef HAVE_GSSAPI
-      else if (auth->type == AUTH_NEGOTIATE)
+      else if (auth->type == CUPSD_AUTH_NEGOTIATE)
       {
 	auth_supported = "negotiate";
 	num_air        = 1;
@@ -1762,7 +1877,7 @@ cupsdSetPrinterAttrs(cupsd_printer_t *p)
       }
 #endif /* HAVE_GSSAPI */
 
-      if (auth->type != AUTH_NONE)
+      if (auth->type != CUPSD_AUTH_NONE)
         p->type |= CUPS_PRINTER_AUTHENTICATED;
       else
         p->type &= ~CUPS_PRINTER_AUTHENTICATED;
@@ -2634,7 +2749,7 @@ cupsdSetPrinterState(
   if (old_state != s)
   {
     cupsdAddEvent(s == IPP_PRINTER_STOPPED ? CUPSD_EVENT_PRINTER_STOPPED :
-                      CUPSD_EVENT_PRINTER_STATE_CHANGED, p, NULL,
+                      CUPSD_EVENT_PRINTER_STATE, p, NULL,
 		  "%s \"%s\" state changed.",
 		  (p->type & CUPS_PRINTER_CLASS) ? "Class" : "Printer",
 		  p->name);
diff -up cups-1.3.5/test/ipptest.c.1.3.x cups-1.3.5/test/ipptest.c
--- cups-1.3.5/test/ipptest.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/test/ipptest.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   IPP test command for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -268,6 +268,7 @@ do_tests(const char *uri,		/* I - URI to
   {
     printf("Unable to connect to %s on port %d - %s\n", server, port,
            strerror(errno));
+    fclose(fp);
     return (0);
   }
 
diff -up cups-1.3.5/scripting/java/src/com/easysw/cups/IPPAttribute.java.1.3.x cups-1.3.5/scripting/java/src/com/easysw/cups/IPPAttribute.java
--- cups-1.3.5/scripting/java/src/com/easysw/cups/IPPAttribute.java.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/scripting/java/src/com/easysw/cups/IPPAttribute.java	2008-02-14 13:03:30.000000000 +0000
@@ -7,7 +7,7 @@ package com.easysw.cups;
  *   Internet Printing Protocol definitions for the Common UNIX Printing
  *   System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2002 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -263,7 +263,9 @@ public class IPPAttribute
   {
     IPPValue val;
     int      bytes = 0;          // Start with one for the group tag.
-   
+    Charset  utf8 = Charset::forName("UTF-8");
+    ByteBuffer temp;
+
     //
     //  Add 1 if first time, or group tag changes.
     //
@@ -308,8 +310,12 @@ public class IPPAttribute
         case IPPDefs.TAG_CHARSET:
         case IPPDefs.TAG_LANGUAGE:
         case IPPDefs.TAG_MIMETYPE:
+	    temp = utf8.encode(val.text);
             bytes += 2;
-	    bytes += val.text.length();
+	    if (temp.capacity() > 32767)
+	      bytes += 32767;
+	    else
+	      bytes += temp.capacity();
 	    break;
 
         case IPPDefs.TAG_DATE :
@@ -329,9 +335,13 @@ public class IPPAttribute
 
         case IPPDefs.TAG_TEXTLANG :
         case IPPDefs.TAG_NAMELANG :
+	    temp = utf8.encode(val.text);
             bytes += 6;  // 2 overall len, 2 charset len, 2 text len
-	    bytes += val.charset.length() +
-	             val.text.length();
+	    bytes += val.charset.length();
+	    if (temp.capacity() > 32767)
+	      bytes += 32767;
+	    else
+	      bytes += temp.capacity();
 	    break;
 
         default :
@@ -359,6 +369,8 @@ public class IPPAttribute
     int    i,j, n;
     int    bi    = 0;          // Start with one for the group tag.
     byte[] bytes = new byte[sz];
+    Charset  utf8 = Charset::forName("UTF-8");
+    ByteBuffer temp;
 
     if (group_tag != last_group)
     {
@@ -412,12 +424,16 @@ public class IPPAttribute
         case IPPDefs.TAG_CHARSET :
         case IPPDefs.TAG_LANGUAGE :
         case IPPDefs.TAG_MIMETYPE :
-            bytes[bi++] = (byte)((val.text.length() & 0xff00) >> 8);
-            bytes[bi++] = (byte)(val.text.length() & 0xff);
-            for (j=0; j < val.text.length(); j++)
-            {
-              bytes[bi++] = (byte)val.text.charAt(j);
-            }
+	    temp = utf8.encode(val.text);
+	    n    = temp.capacity();
+	    
+	    if (n > 32767)
+	      n = 32767;
+
+            bytes[bi++] = (byte)((n & 0x7f00) >> 8);
+            bytes[bi++] = (byte)(n & 0xff);
+	    temp.get(bytes, bi, n);
+	    bi += n;
 	    break;
 
         case IPPDefs.TAG_DATE:
@@ -456,23 +472,30 @@ public class IPPAttribute
 
         case IPPDefs.TAG_TEXTLANG :
         case IPPDefs.TAG_NAMELANG :
-            n = val.charset.length() +
-                val.text.length() + 4;
-            bytes[bi++] = (byte)((n & 0xff00) >> 8);
+	    temp = utf8.encode(val.text);
+	    n    = temp.capacity() + val.charset.length() + 4;
+
+	    if (n > 32767)
+	      n = 32767;
+
+            bytes[bi++] = (byte)((n & 0x7f00) >> 8);
             bytes[bi++] = (byte)(n & 0xff);
 
             n = val.charset.length();
-            bytes[bi++] = (byte)((n & 0xff00) >> 8);
+            bytes[bi++] = (byte)((n & 0x7f00) >> 8);
             bytes[bi++] = (byte)(n & 0xff);
             for (j=0; j < val.charset.length(); j++)
               bytes[bi++] = (byte)val.charset.charAt(j);
-            
-            n = val.text.length();
-            bytes[bi++] = (byte)((n & 0xff00) >> 8);
+
+            n = temp.capacity();
+
+	    if (n > 32767)
+	      n = 32767;
+
+            bytes[bi++] = (byte)((n & 0x7f00) >> 8);
             bytes[bi++] = (byte)(n & 0xff);
-            for (j=0; j < (byte)val.text.length(); j++)
-              bytes[bi++] = (byte)val.text.charAt(j);
-            
+	    temp.get(bytes, bi, n);
+	    bi += n;
 	    break;
 
         default :
diff -up cups-1.3.5/scripting/java/src/com/easysw/cups/Cups.java.1.3.x cups-1.3.5/scripting/java/src/com/easysw/cups/Cups.java
--- cups-1.3.5/scripting/java/src/com/easysw/cups/Cups.java.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/scripting/java/src/com/easysw/cups/Cups.java	2008-02-14 13:03:30.000000000 +0000
@@ -7,7 +7,7 @@ package com.easysw.cups;
  *   Internet Printing Protocol definitions for the Common UNIX Printing
  *   System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2006 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -831,7 +831,7 @@ public class Cups
 
       a = new IPPAttribute( IPPDefs.TAG_OPERATION, IPPDefs.TAG_CHARSET,
                             "attributes-charset" );
-      a.addString( "", "iso-8859-1" );  
+      a.addString( "", "utf-8" );  
       ipp.addAttribute(a);
             
 
@@ -1014,7 +1014,7 @@ public class Cups
 
       a = new IPPAttribute( IPPDefs.TAG_OPERATION, IPPDefs.TAG_CHARSET,
                             "attributes-charset" );
-      a.addString( "", "iso-8859-1" );  
+      a.addString( "", "utf-8" );  
       ipp.addAttribute(a);
             
 
@@ -1091,7 +1091,7 @@ public class Cups
 
       a = new IPPAttribute( IPPDefs.TAG_OPERATION, IPPDefs.TAG_CHARSET,
                             "attributes-charset" );
-      a.addString( "", "iso-8859-1" );  
+      a.addString( "", "utf-8" );  
       ipp.addAttribute(a);
             
 
@@ -1155,7 +1155,7 @@ public class Cups
 
       a = new IPPAttribute( IPPDefs.TAG_OPERATION, IPPDefs.TAG_CHARSET,
                             "attributes-charset" );
-      a.addString( "", "iso-8859-1" );  
+      a.addString( "", "utf-8" );  
       ipp.addAttribute(a);
             
 
@@ -1229,7 +1229,7 @@ public class Cups
 
       a = new IPPAttribute( IPPDefs.TAG_OPERATION, IPPDefs.TAG_CHARSET,
                             "attributes-charset" );
-      a.addString( "", "iso-8859-1" );  
+      a.addString( "", "utf-8" );  
       ipp.addAttribute(a);
 
       // ------------
@@ -1315,7 +1315,7 @@ public class Cups
 
       a = new IPPAttribute( IPPDefs.TAG_OPERATION, IPPDefs.TAG_CHARSET,
                             "attributes-charset" );
-      a.addString( "", "iso-8859-1" );  
+      a.addString( "", "utf-8" );  
       ipp.addAttribute(a);
 
       // ------------
@@ -1375,7 +1375,7 @@ public class Cups
 
       a = new IPPAttribute( IPPDefs.TAG_OPERATION, IPPDefs.TAG_CHARSET,
                             "attributes-charset" );
-      a.addString( "", "iso-8859-1" );  
+      a.addString( "", "utf-8" );  
       ipp.addAttribute(a);
             
 
diff -up cups-1.3.5/CHANGES.txt.1.3.x cups-1.3.5/CHANGES.txt
--- cups-1.3.5/CHANGES.txt.1.3.x	2007-12-17 22:12:45.000000000 +0000
+++ cups-1.3.5/CHANGES.txt	2008-02-14 13:03:30.000000000 +0000
@@ -1,6 +1,98 @@
-CHANGES.txt - 2007-12-17
+CHANGES.txt - 2008-02-12
 ------------------------
 
+CHANGES IN CUPS V1.3.6
+
+	- Documentation updates (STR #2646, STR #2647, STR #2649)
+	- Fixed a problem with the web interface "Use Kerberos
+	  Authentication" check box (STR #2703)
+	- The scheduler unconditionally overwrote the printer-state-
+	  message with "process-name failed" when a filter or backend
+	  failed, preventing a useful error message from being shown
+	  to the user.
+	- Policies on CUPS-Move-Job didn't work as expected (STR
+	  #2699)
+	- The configure script only supported D-BUS on Linux
+	  (STR #2702)
+	- The scheduler did not support </LimitExcept> (STR #2701)
+	- The scheduler did not reset the job-hold-until attribute
+	  after a job's hold time was reached.
+	- The scheduler did not support printer supply attributes
+	  (STR #1307)
+	- The Kerberos credentials provided by some Windows KDCs
+	  were still too large - now use a dynamic buffer to
+	  support credentials up to 64k in size (STR #2695)
+	- Printing a test page from the web interface incorrectly
+	  defaulted to the "guest" user (STR #2688)
+	- The cupsEncodeOptions2() function did not parse multiple-
+	  value attribute values properly (STR #2690)
+	- The scheduler incorrectly sent printer-stopped events for
+	  status updates from the print filters (STR #2680)
+	- The IPP backend could crash when handling printer errors
+	  (STR #2667)
+	- Multi-file jobs did not print to remote CUPS servers
+	  (STR #2673)
+	- The scheduler did not provide the Apple language ID to
+	  job filters.
+	- Kerberos authentication did not work with the web
+	  interface (STR #2606, STR #2669)
+	- The requesing-user-name-allowed and -denied functionality
+	  did not work for Kerberos-authenticated usernames (STR
+	  #2670)
+	- CUPS didn't compile on HP-UX 11i (STR #2679)
+	- cupsEncodeOptions2() did not handle option values like
+	  "What's up, doc?" properly.
+	- Added lots of memory allocation checks (Fortify)
+	- The scheduler would crash if it was unable to add a job
+	  file (Fortify)
+	- ppdOpen*() did not check all memory allocations (Coverity)
+	- ippReadIO() did not check all memory allocations (Coverity)
+	- The PostScript filter did not detect read errors (Coverity)
+	- The scheduler did not check for a missing job-sheets-completed
+	  attribute when sending an event notification (Coverity)
+	- "Set Printer Options" might not work with raw queues (Coverity)
+	- cupsRasterInterpretPPD() could crash on certain PostScript
+	  errors (Coverity)
+	- The USB backend did not check for back-channel support
+	  properly on all systems (Coverity)
+	- Fixed memory leaks in the GIF and PNM image loading code
+	  (Coverity)
+	- Removed some dead code in the CUPS API and scheduler (Coverity)
+	- Fixed two overflow bugs in the HP-GL/2 filter (Coverity)
+	- Fixed another ASN1 string parsing bug (STR #2665)
+	- The RSS notifier directory was not installed with the
+	  correct permissions.
+	- The standard CUPS backends could use 100% CPU while waiting
+	  for print data (STR #2664)
+	- Filename-based MIME rules did not work (STR #2659)
+	- The cups-polld program did not exit if the scheduler crashed
+	  (STR #2640)
+	- The scheduler would crash if you tried to set the port-monitor
+	  on a raw queue (STR #2639)
+	- The scheduler could crash if a polled remote printer was
+	  converted to a class (STR #2656)
+	- The web interface and cupsctl did not correctly reflect
+	  the "allow printing from the Internet" state (STR #2650)
+	- The scheduler incorrectly treated MIME types as case-
+	  sensitive (STR #2657)
+	- The Java support classes did not send UTF-8 strings to
+	  the scheduler (STR #2651)
+	- The CGI code did not handle interrupted POST requests
+	  properly (STR #2652)
+	- The PostScript filter incorrectly handled number-up when
+	  the number of pages was evenly divisible by the number-up
+	  value.
+	- The PDF filter incorrectly filtered pages when page-ranges
+	  and number-up were both specified (STR #2643)
+	- The IPP backend did not handle printing of pictwps files
+	  to a non-Mac CUPS server properly.
+	- The scheduler did not detect network interface changes
+	  on operating systems other than Mac OS X (STR #2631)
+	- The scheduler now logs the UNIX error message when it
+	  is unable to create a request file such as a print job.
+	- Added support for --enable-pie on Mac OS X.
+
+
 CHANGES IN CUPS V1.3.5
 
 	- The SNMP backend did not check for negative string
diff -up cups-1.3.5/conf/cupsd.conf.in.1.3.x cups-1.3.5/conf/cupsd.conf.in
--- cups-1.3.5/conf/cupsd.conf.in.1.3.x	2007-07-25 01:40:03.000000000 +0100
+++ cups-1.3.5/conf/cupsd.conf.in	2008-02-14 13:03:30.000000000 +0000
@@ -29,14 +29,12 @@ DefaultAuthType Basic
 # Restrict access to the server...
 <Location />
   Order allow,deny
-  Allow localhost
 </Location>
 
 # Restrict access to the admin pages...
 <Location /admin>
 @ENCRYPTION_REQUIRED@
   Order allow,deny
-  Allow localhost
 </Location>
 
 # Restrict access to configuration files...
@@ -44,7 +42,6 @@ DefaultAuthType Basic
   AuthType Default
   Require user @SYSTEM
   Order allow,deny
-  Allow localhost
 </Location>
 
 # Set the default printer/job policies...
diff -up cups-1.3.5/templates/trailer.tmpl.1.3.x cups-1.3.5/templates/trailer.tmpl
--- cups-1.3.5/templates/trailer.tmpl.1.3.x	2007-12-07 18:37:40.000000000 +0000
+++ cups-1.3.5/templates/trailer.tmpl	2008-02-14 13:03:30.000000000 +0000
@@ -6,9 +6,9 @@
 WIDTH="15" HEIGHT="15" ALT=""></TD>
 <TD COLSPAN="2" WIDTH="100%" STYLE="padding: 5;">
 
-<P><SMALL>The Common UNIX Printing System, CUPS, and the CUPS logo are the
-trademark property of <A HREF="http://www.apple.com">Apple Inc.</A> CUPS
-is copyright 2007 by Apple Inc., all rights reserved.</SMALL></P>
+<P><SMALL>The Common UNIX Printing System, CUPS, and the CUPS logo are
+trademarks of <A HREF="http://www.apple.com">Apple Inc.</A> CUPS is
+copyright 2007-2008 Apple Inc. All rights reserved.</SMALL></P>
 
 </TD>
 
diff -up cups-1.3.5/config-scripts/cups-compiler.m4.1.3.x cups-1.3.5/config-scripts/cups-compiler.m4
--- cups-1.3.5/config-scripts/cups-compiler.m4.1.3.x	2007-09-18 21:39:31.000000000 +0100
+++ cups-1.3.5/config-scripts/cups-compiler.m4	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@ dnl "$Id: cups-compiler.m4 6976 2007-09-
 dnl
 dnl   Compiler stuff for the Common UNIX Printing System (CUPS).
 dnl
-dnl   Copyright 2007 by Apple Inc.
+dnl   Copyright 2007-2008 by Apple Inc.
 dnl   Copyright 1997-2007 by Easy Software Products, all rights reserved.
 dnl
 dnl   These coded instructions, statements, and computer programs are the
@@ -98,36 +98,56 @@ if test -n "$GCC"; then
 		fi
 	fi
 
+	# Generate position-independent code as needed...
 	if test $PICFLAG = 1 -a $uname != AIX; then
     		OPTIM="-fPIC $OPTIM"
 	fi
 
-	case $uname in
-		Linux*)
-			if test x$enable_pie = xyes; then
-				PIEFLAGS="-pie -fPIE"
-			fi
-
-			if test x$enable_relro = xyes; then
-				RELROFLAGS="-Wl,-z,relro"
-			fi
-			;;
-
-		*)
-			if test x$enable_pie = xyes; then
-				echo "Sorry, --enable-pie is not supported on this OS!"
-			fi
-			;;
-	esac
+	# The -fstack-protector option is available with some versions of
+	# GCC and adds "stack canaries" which detect when the return address
+	# has been overwritten, preventing many types of exploit attacks.
+	AC_MSG_CHECKING(if GCC supports -fstack-protector)
+	OLDCFLAGS="$CFLAGS"
+	CFLAGS="$CFLAGS -fstack-protector"
+	AC_TRY_COMPILE(,,
+		OPTIM="$OPTIM -fstack-protector"
+		AC_MSG_RESULT(yes),
+		AC_MSG_RESULT(no))
+	CFLAGS="$OLDCFLAGS"
+
+	# The -pie option is available with some versions of GCC and adds
+	# randomization of addresses, which avoids another class of exploits
+	# that depend on a fixed address for common functions.
+	if test x$enable_pie = xyes; then
+		AC_MSG_CHECKING(if GCC supports -pie)
+		OLDCFLAGS="$CFLAGS"
+		CFLAGS="$CFLAGS -pie -fPIE"
+		AC_TRY_COMPILE(,,
+			PIEFLAGS="-pie -fPIE"
+			AC_MSG_RESULT(yes),
+			AC_MSG_RESULT(no, ignoring --enable-pie))
+		CFLAGS="$OLDCFLAGS"
+	fi
 
 	if test "x$with_optim" = x; then
 		# Add useful warning options for tracking down problems...
 		OPTIM="-Wall -Wno-format-y2k $OPTIM"
-		# Additional warning options for alpha testing...
-		OPTIM="-Wshadow -Wunused $OPTIM"
+		# Additional warning options for development testing...
+		if test -d .svn; then
+			OPTIM="-Wshadow -Wunused $OPTIM"
+		fi
 	fi
 
 	case "$uname" in
+		Darwin*)
+			# -D_FORTIFY_SOURCE=2 adds additional object size
+			# checking, basically wrapping all string functions
+			# with buffer-limited ones.  Not strictly needed for
+			# CUPS since we already use buffer-limited calls, but
+			# this will catch any additions that are broken.		
+			CFLAGS="$CFLAGS -D_FORTIFY_SOURCE=2"
+			;;
+
 		HP-UX*)
 			if test "x$enable_32bit" = xyes; then
 				# Build 32-bit libraries, 64-bit base...
@@ -201,6 +221,12 @@ if test -n "$GCC"; then
 			;;
 
 		Linux*)
+			# The -z relro option is provided by the Linux linker command to
+			# make relocatable data read-only.
+			if test x$enable_relro = xyes; then
+				RELROFLAGS="-Wl,-z,relro"
+			fi
+
 			if test "x$enable_32bit" = xyes; then
 				# Build 32-bit libraries, 64-bit base...
 				if test -z "$with_arch32flags"; then
@@ -468,8 +494,8 @@ else
 			# cups-support@cups.org...
 			echo "Building CUPS with default compiler optimizations; contact"
 			echo "cups-bugs@cups.org with uname and compiler options needed"
-			echo "for your platform, or set the CFLAGS and CXXFLAGS"
-			echo "environment variable before running configure."
+			echo "for your platform, or set the CFLAGS, CXXFLAGS, and LDFLAGS"
+			echo "environment variables before running configure."
 			;;
 	esac
 fi
diff -up cups-1.3.5/config-scripts/cups-network.m4.1.3.x cups-1.3.5/config-scripts/cups-network.m4
--- cups-1.3.5/config-scripts/cups-network.m4.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/config-scripts/cups-network.m4	2008-02-14 13:03:30.000000000 +0000
@@ -29,24 +29,6 @@ fi
 AC_CHECK_MEMBER(struct sockaddr.sa_len,,, [#include <sys/socket.h>])
 AC_CHECK_HEADER(sys/sockio.h, AC_DEFINE(HAVE_SYS_SOCKIO_H))
 
-if test "$uname" = "SunOS"; then
-	case "$uversion" in
-		55* | 56*)
-			maxfiles=1024
-			;;
-		*)
-			maxfiles=4096
-			;;
-	esac
-else
-	maxfiles=4096
-fi
-
-AC_ARG_WITH(maxfiles, [  --with-maxfiles=N       set maximum number of file descriptors for scheduler ],
-	maxfiles=$withval)
-
-AC_DEFINE_UNQUOTED(CUPS_MAX_FDS, $maxfiles)
-
 CUPS_DEFAULT_DOMAINSOCKET=""
 
 dnl Domain socket support...
diff -up cups-1.3.5/config-scripts/cups-defaults.m4.1.3.x cups-1.3.5/config-scripts/cups-defaults.m4
--- cups-1.3.5/config-scripts/cups-defaults.m4.1.3.x	2007-08-01 20:00:07.000000000 +0100
+++ cups-1.3.5/config-scripts/cups-defaults.m4	2008-02-14 13:03:30.000000000 +0000
@@ -4,7 +4,7 @@ dnl
 dnl   Default cupsd configuration settings for the Common UNIX Printing System
 dnl   (CUPS).
 dnl
-dnl   Copyright 2007 by Apple Inc.
+dnl   Copyright 2007-2008 by Apple Inc.
 dnl   Copyright 2006-2007 by Easy Software Products, all rights reserved.
 dnl
 dnl   These coded instructions, statements, and computer programs are the
@@ -337,6 +337,14 @@ AC_ARG_WITH(snmp-community, [  --with-sn
 AC_SUBST(CUPS_SNMP_ADDRESS)
 AC_SUBST(CUPS_SNMP_COMMUNITY)
 
+dnl New default port definition for IPP...
+AC_ARG_WITH(ipp-port, [  --with-ipp-port         set default port number for IPP ],
+	DEFAULT_IPP_PORT="$withval",
+	DEFAULT_IPP_PORT="631")
+
+AC_SUBST(DEFAULT_IPP_PORT)
+AC_DEFINE_UNQUOTED(CUPS_DEFAULT_IPP_PORT,$DEFAULT_IPP_PORT)
+
 dnl
 dnl End of "$Id: cups-defaults.m4 6754 2007-08-01 19:00:07Z mike $".
 dnl
diff -up cups-1.3.5/config-scripts/cups-common.m4.1.3.x cups-1.3.5/config-scripts/cups-common.m4
--- cups-1.3.5/config-scripts/cups-common.m4.1.3.x	2007-12-17 22:14:15.000000000 +0000
+++ cups-1.3.5/config-scripts/cups-common.m4	2008-02-14 13:03:30.000000000 +0000
@@ -183,37 +183,60 @@ esac
 
 AC_SUBST(ARFLAGS)
 
-dnl Extra platform-specific libraries...
+dnl Prep libraries specifically for cupsd and backends...
 BACKLIBS=""
 CUPSDLIBS=""
-DBUSDIR=""
-CUPS_DEFAULT_PRINTADMIN_AUTH="@SYSTEM"
-CUPS_SYSTEM_AUTHKEY=""
+AC_SUBST(BACKLIBS)
+AC_SUBST(CUPSDLIBS)
+
+dnl See if we have POSIX ACL support...
+SAVELIBS="$LIBS"
+LIBS=""
+AC_SEARCH_LIBS(acl_init, acl, AC_DEFINE(HAVE_ACL_INIT))
+CUPSDLIBS="$CUPSDLIBS $LIBS"
+LIBS="$SAVELIBS"
 
+dnl Check for DBUS support
 AC_ARG_ENABLE(dbus, [  --enable-dbus           enable DBUS support, default=auto])
+AC_ARG_WITH(dbusdir, [  --with-dbusdir          set DBUS configuration directory ],
+	DBUSDIR="$withval"
+	DBUSDIR="/etc/dbus-1")
+
+if test "x$enable_dbus" != xno; then
+	AC_PATH_PROG(PKGCONFIG, pkg-config)
+	if test "x$PKGCONFIG" != x; then
+		AC_MSG_CHECKING(for DBUS)
+		if $PKGCONFIG --exists dbus-1; then
+			AC_MSG_RESULT(yes)
+			AC_DEFINE(HAVE_DBUS)
+			CFLAGS="$CFLAGS `$PKGCONFIG --cflags dbus-1` -DDBUS_API_SUBJECT_TO_CHANGE"
+			CUPSDLIBS="$CUPSDLIBS `$PKGCONFIG --libs dbus-1`"
+			AC_CHECK_LIB(dbus-1,
+			    dbus_message_iter_init_append,
+			    AC_DEFINE(HAVE_DBUS_MESSAGE_ITER_INIT_APPEND))
+		else
+			AC_MSG_RESULT(no)
+			DBUSDIR=""
+		fi
+	fi
+fi
+
+AC_SUBST(DBUSDIR)
 
+dnl Extra platform-specific libraries...
+CUPS_DEFAULT_PRINTADMIN_AUTH="@SYSTEM"
+CUPS_SYSTEM_AUTHKEY=""
 FONTS="fonts"
-AC_SUBST(FONTS)
 LEGACY_BACKENDS="parallel scsi"
-AC_SUBST(LEGACY_BACKENDS)
 
 case $uname in
         Darwin*)
 		FONTS=""
 		LEGACY_BACKENDS=""
-                BACKLIBS="-framework IOKit"
-                CUPSDLIBS="-sectorder __TEXT __text cupsd.order -e start -framework IOKit -framework SystemConfiguration"
+                BACKLIBS="$BACKLIBS -framework IOKit"
+                CUPSDLIBS="$CUPSDLIBS -sectorder __TEXT __text cupsd.order -e start -framework IOKit -framework SystemConfiguration"
                 LIBS="-framework CoreFoundation $LIBS"
 
-		dnl Check for CFLocaleCreateCanonicalLocaleIdentifierFromString...
-		AC_MSG_CHECKING(for CFLocaleCreateCanonicalLocaleIdentifierFromString)
-		if test "$uname" = "Darwin" -a $uversion -ge 70; then
-			AC_DEFINE(HAVE_CF_LOCALE_ID)
-			AC_MSG_RESULT(yes)
-		else
-			AC_MSG_RESULT(no)
-		fi
-
 		dnl Check for framework headers...
 		AC_CHECK_HEADER(CoreFoundation/CoreFoundation.h,AC_DEFINE(HAVE_COREFOUNDATION_H))
 		AC_CHECK_HEADER(CoreFoundation/CFPriv.h,AC_DEFINE(HAVE_CFPRIV_H))
@@ -238,53 +261,13 @@ case $uname in
 			CUPS_SYSTEM_AUTHKEY="SystemGroupAuthKey system.preferences"])
 		AC_CHECK_HEADER(Security/SecBasePriv.h,AC_DEFINE(HAVE_SECBASEPRIV_H))
                 ;;
-
-	Linux*)
-		dnl Check for DBUS support
-		if test "x$enable_dbus" != xno; then
-			AC_PATH_PROG(PKGCONFIG, pkg-config)
-			if test "x$PKGCONFIG" != x; then
-				AC_MSG_CHECKING(for DBUS)
-				if $PKGCONFIG --exists dbus-1; then
-					AC_MSG_RESULT(yes)
-					AC_DEFINE(HAVE_DBUS)
-					CFLAGS="$CFLAGS `$PKGCONFIG --cflags dbus-1` -DDBUS_API_SUBJECT_TO_CHANGE"
-					CUPSDLIBS="`$PKGCONFIG --libs dbus-1`"
-					AC_ARG_WITH(dbusdir, [  --with-dbusdir          set DBUS configuration directory ], dbusdir="$withval", dbusdir="/etc/dbus-1")
-					DBUSDIR="$dbusdir"
-					AC_CHECK_LIB(dbus-1,
-					    dbus_message_iter_init_append,
-					    AC_DEFINE(HAVE_DBUS_MESSAGE_ITER_INIT_APPEND))
-				else
-					AC_MSG_RESULT(no)
-				fi
-			fi
-		fi
-		;;
 esac
 
 AC_SUBST(CUPS_DEFAULT_PRINTADMIN_AUTH)
 AC_DEFINE_UNQUOTED(CUPS_DEFAULT_PRINTADMIN_AUTH, "$CUPS_DEFAULT_PRINTADMIN_AUTH")
 AC_SUBST(CUPS_SYSTEM_AUTHKEY)
-
-dnl See if we have POSIX ACL support...
-SAVELIBS="$LIBS"
-LIBS=""
-AC_SEARCH_LIBS(acl_init, acl, AC_DEFINE(HAVE_ACL_INIT))
-CUPSDLIBS="$CUPSDLIBS $LIBS"
-LIBS="$SAVELIBS"
-
-AC_SUBST(BACKLIBS)
-AC_SUBST(CUPSDLIBS)
-AC_SUBST(DBUSDIR)
-
-dnl New default port definition for IPP...
-AC_ARG_WITH(ipp-port, [  --with-ipp-port         set default port number for IPP ],
-	DEFAULT_IPP_PORT="$withval",
-	DEFAULT_IPP_PORT="631")
-
-AC_SUBST(DEFAULT_IPP_PORT)
-AC_DEFINE_UNQUOTED(CUPS_DEFAULT_IPP_PORT,$DEFAULT_IPP_PORT)
+AC_SUBST(FONTS)
+AC_SUBST(LEGACY_BACKENDS)
 
 dnl
 dnl End of "$Id: cups-common.m4 7057 2007-11-01 23:29:14Z mike $".
diff -up cups-1.3.5/man/lpq.man.1.3.x cups-1.3.5/man/lpq.man
--- cups-1.3.5/man/lpq.man.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/man/lpq.man	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
 .\"
 .\"   lpq man page for the Common UNIX Printing System (CUPS).
 .\"
-.\"   Copyright 2007 by Apple Inc.
+.\"   Copyright 2007-2008 by Apple Inc.
 .\"   Copyright 1997-2006 by Easy Software Products.
 .\"
 .\"   These coded instructions, statements, and computer programs are the
@@ -12,7 +12,7 @@
 .\"   which should have been included with this file.  If this file is
 .\"   file is missing or damaged, see the license at "http://www.cups.org/".
 .\"
-.TH lpq 1 "Common UNIX Printing System" "12 February 2006" "Apple Inc."
+.TH lpq 1 "Common UNIX Printing System" "2 January 2008" "Apple Inc."
 .SH NAME
 lpq \- show printer queue status
 .SH SYNOPSIS
@@ -33,7 +33,7 @@ no printer or class is specified on the 
 .LP
 The \fI+interval\fR option allows you to continuously report the
 jobs in the queue until the queue is empty; the list of jobs is
-show one every \fIinterval\fR seconds.
+show once every \fIinterval\fR seconds.
 .SH OPTIONS
 \fIlpq\fR supports the following options:
 .TP 5
@@ -66,7 +66,7 @@ Requests a more verbose (long) reporting
 .br
 http://localhost:631/help
 .SH COPYRIGHT
-Copyright 2007 by Apple Inc.
+Copyright 2007-2008 by Apple Inc.
 .\"
 .\" End of "$Id: lpq.man 6649 2007-07-11 21:46:42Z mike $".
 .\"
diff -up cups-1.3.5/man/lpadmin.man.1.3.x cups-1.3.5/man/lpadmin.man
--- cups-1.3.5/man/lpadmin.man.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/man/lpadmin.man	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
 .\"
 .\"   lpadmin man page for the Common UNIX Printing System (CUPS).
 .\"
-.\"   Copyright 2007 by Apple Inc.
+.\"   Copyright 2007-2008 by Apple Inc.
 .\"   Copyright 1997-2006 by Easy Software Products.
 .\"
 .\"   These coded instructions, statements, and computer programs are the
@@ -12,7 +12,7 @@
 .\"   which should have been included with this file.  If this file is
 .\"   file is missing or damaged, see the license at "http://www.cups.org/".
 .\"
-.TH lpadmin 8 "Common UNIX Printing System" "13 July 2006" "Apple Inc."
+.TH lpadmin 8 "Common UNIX Printing System" "2 January 2008" "Apple Inc."
 .SH NAME
 lpadmin \- configure cups printers and classes
 .SH SYNOPSIS
@@ -81,12 +81,6 @@ and is intended for providing support fo
 Sets a standard System V interface script or PPD file from the
 \fImodel\fR directory.
 .TP 5
--o name=value
-.br
-Sets a PPD or server option for the printer. PPD options can be
-listed using the \fI-l\fR option with the \fIlpoptions(1)\fR
-command.
-.TP 5
 -o job-k-limit=value
 .br
 Sets the kilobyte limit for per-user quotas. The value is an
@@ -109,10 +103,23 @@ integer number of seconds; 86,400 second
 .br
 Sets the default banner page(s) to use for print jobs.
 .TP 5
+-o name=value
+.br
+Sets a PPD option for the printer. PPD options can be
+listed using the \fI-l\fR option with the \fIlpoptions(1)\fR
+command.
+.TP 5
+-o name-default=value
+.br
+Sets a default server-side option for the printer. Any print-time
+option can be defaulted, e.g. "-o cpi-default=17" to set the default
+"cpi" option value to 17.
+.TP 5
 -o port-monitor=name
 .br
 Sets the binary communications program to use when printing,
-"none", "bcp", or "tbcp". The default program is "none".
+"none", "bcp", or "tbcp". The default program is "none". The
+specified port monitor must be listed in the printer's PPD file.
 .TP 5
 -o printer-error-policy=name
 .br
@@ -194,7 +201,7 @@ System V or Solaris printing system conf
 .br
 http://localhost:631/help
 .SH COPYRIGHT
-Copyright 2007 by Apple Inc.
+Copyright 2007-2008 by Apple Inc.
 .\"
 .\" End of "$Id: lpadmin.man 6649 2007-07-11 21:46:42Z mike $".
 .\"
diff -up cups-1.3.5/man/cupsd.conf.man.in.1.3.x cups-1.3.5/man/cupsd.conf.man.in
--- cups-1.3.5/man/cupsd.conf.man.in.1.3.x	2007-10-02 00:11:47.000000000 +0100
+++ cups-1.3.5/man/cupsd.conf.man.in	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
 .\"
 .\"   cupsd.conf man page for the Common UNIX Printing System (CUPS).
 .\"
-.\"   Copyright 2007 by Apple Inc.
+.\"   Copyright 2007-2008 by Apple Inc.
 .\"   Copyright 1997-2006 by Easy Software Products.
 .\"
 .\"   These coded instructions, statements, and computer programs are the
@@ -12,7 +12,7 @@
 .\"   which should have been included with this file.  If this file is
 .\"   file is missing or damaged, see the license at "http://www.cups.org/".
 .\"
-.TH cupsd.conf 5 "Common UNIX Printing System" "6 June 2006" "Apple Inc."
+.TH cupsd.conf 5 "Common UNIX Printing System" "2 January 2008" "Apple Inc."
 .SH NAME
 cupsd.conf \- server configuration file for cups
 .SH DESCRIPTION
@@ -230,6 +230,12 @@ DefaultPolicy policy-name
 .br
 Specifies the default access policy to use.
 .TP 5
+DefaultShared Yes
+.TP 5
+DefaultShared No
+.br
+Specifies whether local printers are shared by default.
+.TP 5
 Deny all
 .TP 5
 Deny none
@@ -606,7 +612,7 @@ Specifies the user name or ID that is us
 .br
 http://localhost:631/help
 .SH COPYRIGHT
-Copyright 2007 by Apple Inc.
+Copyright 2007-2008 by Apple Inc.
 .\"
 .\" End of "$Id: cupsd.conf.man.in 7004 2007-10-01 23:11:47Z mike $".
 .\"
diff -up cups-1.3.5/INSTALL.txt.1.3.x cups-1.3.5/INSTALL.txt
--- cups-1.3.5/INSTALL.txt.1.3.x	2007-09-18 21:39:31.000000000 +0100
+++ cups-1.3.5/INSTALL.txt	2008-02-14 13:03:30.000000000 +0000
@@ -1,4 +1,4 @@
-INSTALL - CUPS v1.3.2 - 2007-09-18
+INSTALL - CUPS v1.3.6 - 2008-01-22
 ----------------------------------
 
 This file describes how to compile and install CUPS from source
@@ -31,9 +31,8 @@ BEFORE YOU BEGIN
     compile and run without these, however you'll miss out on
     many of the features provided by CUPS.
 
-    Kerberos support requires a very recent version of the MIT
-    implementation with the krb5_cc_new_unique() function or the
-    Heimdal implementation, along with the corresponding GSSAPI
+    Kerberos support requires MIT Kerberos 1.6.3 or later or
+    or Heimdal Kerberos, along with the corresponding GSSAPI
     pieces.
 
     Also, please note that CUPS no longer includes the
@@ -47,7 +46,7 @@ COMPILING FROM SUBVERSION
 
     The CUPS Subversion repository doesn't hold a copy of the
     pre-built configure script.  You'll need to run the GNU
-    autoconf software (2.52 or higher) before compiling the
+    autoconf software (2.60 or higher) before compiling the
     software from Subversion:
 
 	autoconf -f
diff -up cups-1.3.5/filter/pstops.c.1.3.x cups-1.3.5/filter/pstops.c
--- cups-1.3.5/filter/pstops.c.1.3.x	2007-11-09 19:54:09.000000000 +0000
+++ cups-1.3.5/filter/pstops.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   PostScript filter for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1993-2007 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -164,27 +164,27 @@ static void		cancel_job(int sig);
 static int		check_range(pstops_doc_t *doc, int page);
 static void		copy_bytes(cups_file_t *fp, off_t offset,
 			           size_t length);
-static size_t		copy_comments(cups_file_t *fp, pstops_doc_t *doc,
+static ssize_t		copy_comments(cups_file_t *fp, pstops_doc_t *doc,
 			              ppd_file_t *ppd, char *line,
-				      size_t linelen, size_t linesize);
+				      ssize_t linelen, size_t linesize);
 static void		copy_dsc(cups_file_t *fp, pstops_doc_t *doc,
-			         ppd_file_t *ppd, char *line, size_t linelen,
+			         ppd_file_t *ppd, char *line, ssize_t linelen,
 				 size_t linesize);
 static void		copy_non_dsc(cups_file_t *fp, pstops_doc_t *doc,
 			             ppd_file_t *ppd, char *line,
-				     size_t linelen, size_t linesize);
-static size_t		copy_page(cups_file_t *fp, pstops_doc_t *doc,
+				     ssize_t linelen, size_t linesize);
+static ssize_t		copy_page(cups_file_t *fp, pstops_doc_t *doc,
 			          ppd_file_t *ppd, int number, char *line,
-				  size_t linelen, size_t linesize);
-static size_t		copy_prolog(cups_file_t *fp, pstops_doc_t *doc,
+				  ssize_t linelen, size_t linesize);
+static ssize_t		copy_prolog(cups_file_t *fp, pstops_doc_t *doc,
 			            ppd_file_t *ppd, char *line,
-				    size_t linelen, size_t linesize);
-static size_t		copy_setup(cups_file_t *fp, pstops_doc_t *doc,
+				    ssize_t linelen, size_t linesize);
+static ssize_t		copy_setup(cups_file_t *fp, pstops_doc_t *doc,
 			           ppd_file_t *ppd, char *line,
-				   size_t linelen, size_t linesize);
-static size_t		copy_trailer(cups_file_t *fp, pstops_doc_t *doc,
+				   ssize_t linelen, size_t linesize);
+static ssize_t		copy_trailer(cups_file_t *fp, pstops_doc_t *doc,
 			             ppd_file_t *ppd, int number, char *line,
-				     size_t linelen, size_t linesize);
+				     ssize_t linelen, size_t linesize);
 static void		do_prolog(pstops_doc_t *doc, ppd_file_t *ppd);
 static void 		do_setup(pstops_doc_t *doc, ppd_file_t *ppd);
 static void		doc_printf(pstops_doc_t *doc, const char *format, ...)
@@ -203,7 +203,7 @@ static char		*parse_text(const char *sta
 static void		set_pstops_options(pstops_doc_t *doc, ppd_file_t *ppd,
 			                   char *argv[], int num_options,
 			                   cups_option_t *options);
-static size_t		skip_page(cups_file_t *fp, char *line, size_t linelen,
+static ssize_t		skip_page(cups_file_t *fp, char *line, ssize_t linelen,
 				  size_t linesize);
 static void		start_nup(pstops_doc_t *doc, int number,
 				  int show_border, const int *bounding_box);
@@ -581,12 +581,12 @@ copy_bytes(cups_file_t *fp,		/* I - File
  * On return, "line" will contain the next line in the file, if any.
  */
 
-static size_t				/* O - Length of next line */
+static ssize_t				/* O - Length of next line */
 copy_comments(cups_file_t  *fp,		/* I - File to read from */
               pstops_doc_t *doc,	/* I - Document info */
 	      ppd_file_t   *ppd,	/* I - PPD file */
               char         *line,	/* I - Line buffer */
-	      size_t       linelen,	/* I - Length of initial line */
+	      ssize_t      linelen,	/* I - Length of initial line */
 	      size_t       linesize)	/* I - Size of line buffer */
 {
   int	saw_bounding_box,		/* Saw %%BoundingBox: comment? */
@@ -809,7 +809,7 @@ copy_dsc(cups_file_t  *fp,		/* I - File 
          pstops_doc_t *doc,		/* I - Document info */
          ppd_file_t   *ppd,		/* I - PPD file */
 	 char         *line,		/* I - Line buffer */
-	 size_t       linelen,		/* I - Length of initial line */
+	 ssize_t      linelen,		/* I - Length of initial line */
 	 size_t       linesize)		/* I - Size of line buffer */
 {
   int		number;			/* Page number */
@@ -889,7 +889,8 @@ copy_dsc(cups_file_t  *fp,		/* I - File 
   * Finish up the last page(s)...
   */
 
-  if (number && !is_first_page(number) && cupsArrayLast(doc->pages))
+  if (number && is_not_last_page(number) && cupsArrayLast(doc->pages) &&
+      check_range(doc, (number - 1) / doc->number_up + 1))
   {
     pageinfo = (pstops_page_t *)cupsArrayLast(doc->pages);
 
@@ -930,7 +931,7 @@ copy_dsc(cups_file_t  *fp,		/* I - File 
 
   number = doc->slow_order ? 0 : doc->page;
 
-  if (doc->temp && !JobCanceled)
+  if (doc->temp && !JobCanceled && cupsArrayCount(doc->pages) > 0)
   {
     int	copy;				/* Current copy */
 
@@ -1068,7 +1069,7 @@ copy_non_dsc(cups_file_t  *fp,		/* I - F
              pstops_doc_t *doc,		/* I - Document info */
              ppd_file_t   *ppd,		/* I - PPD file */
 	     char         *line,	/* I - Line buffer */
-	     size_t       linelen,	/* I - Length of initial line */
+	     ssize_t      linelen,	/* I - Length of initial line */
 	     size_t       linesize)	/* I - Size of line buffer */
 {
   int	copy;				/* Current copy */
@@ -1244,13 +1245,13 @@ copy_non_dsc(cups_file_t  *fp,		/* I - F
  * On return, "line" will contain the next line in the file, if any.
  */
 
-static size_t				/* O - Length of next line */
+static ssize_t				/* O - Length of next line */
 copy_page(cups_file_t  *fp,		/* I - File to read from */
           pstops_doc_t *doc,		/* I - Document info */
           ppd_file_t   *ppd,		/* I - PPD file */
 	  int          number,		/* I - Current page number */
 	  char         *line,		/* I - Line buffer */
-	  size_t       linelen,		/* I - Length of initial line */
+	  ssize_t      linelen,		/* I - Length of initial line */
 	  size_t       linesize)	/* I - Size of line buffer */
 {
   char		label[256],		/* Page label string */
@@ -1713,12 +1714,12 @@ copy_page(cups_file_t  *fp,		/* I - File
  * On return, "line" will contain the next line in the file, if any.
  */
 
-static size_t				/* O - Length of next line */
+static ssize_t				/* O - Length of next line */
 copy_prolog(cups_file_t  *fp,		/* I - File to read from */
             pstops_doc_t *doc,		/* I - Document info */
             ppd_file_t   *ppd,		/* I - PPD file */
 	    char         *line,		/* I - Line buffer */
-	    size_t       linelen,	/* I - Length of initial line */
+	    ssize_t      linelen,	/* I - Length of initial line */
 	    size_t       linesize)	/* I - Size of line buffer */
 {
   while (strncmp(line, "%%BeginProlog", 13))
@@ -1767,12 +1768,12 @@ copy_prolog(cups_file_t  *fp,		/* I - Fi
  * On return, "line" will contain the next line in the file, if any.
  */
 
-static size_t				/* O - Length of next line */
+static ssize_t				/* O - Length of next line */
 copy_setup(cups_file_t  *fp,		/* I - File to read from */
            pstops_doc_t *doc,		/* I - Document info */
            ppd_file_t   *ppd,		/* I - PPD file */
 	   char         *line,		/* I - Line buffer */
-	   size_t       linelen,	/* I - Length of initial line */
+	   ssize_t      linelen,	/* I - Length of initial line */
 	   size_t       linesize)	/* I - Size of line buffer */
 {
   while (strncmp(line, "%%BeginSetup", 12))
@@ -1832,13 +1833,13 @@ copy_setup(cups_file_t  *fp,		/* I - Fil
  * On return, "line" will contain the next line in the file, if any.
  */
 
-static size_t				/* O - Length of next line */
+static ssize_t				/* O - Length of next line */
 copy_trailer(cups_file_t  *fp,		/* I - File to read from */
              pstops_doc_t *doc,		/* I - Document info */
              ppd_file_t   *ppd,		/* I - PPD file */
 	     int          number,	/* I - Number of pages */
 	     char         *line,	/* I - Line buffer */
-	     size_t       linelen,	/* I - Length of initial line */
+	     ssize_t      linelen,	/* I - Length of initial line */
 	     size_t       linesize)	/* I - Size of line buffer */
 {
  /*
@@ -2711,10 +2712,10 @@ set_pstops_options(
  * 'skip_page()' - Skip past a page that won't be printed...
  */
 
-static size_t				/* O - Length of next line */
+static ssize_t				/* O - Length of next line */
 skip_page(cups_file_t *fp,		/* I - File to read from */
           char        *line,		/* I - Line buffer */
-	  size_t      linelen,		/* I - Length of initial line */
+	  ssize_t     linelen,		/* I - Length of initial line */
           size_t      linesize)		/* I - Size of line buffer */
 {
   int	level;				/* Embedded document level */
diff -up cups-1.3.5/filter/image-photocd.c.1.3.x cups-1.3.5/filter/image-photocd.c
--- cups-1.3.5/filter/image-photocd.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/filter/image-photocd.c	2008-02-14 13:03:30.000000000 +0000
@@ -7,7 +7,7 @@
  *   is only YCC encoded.  Support for the higher resolution images will
  *   require a lot of extra code...
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1993-2006 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -99,11 +99,33 @@ _cupsImageReadPhotoCD(
   cupsImageSetMaxTiles(img, 0);
 
   bpp = cupsImageGetDepth(img);
-  in  = malloc(768 * 3);
-  out = malloc(768 * bpp);
+
+  if ((in = malloc(768 * 3)) == NULL)
+  {
+    fputs("DEBUG: Unable to allocate memory!\n", stderr);
+    fclose(fp);
+    return (1);
+  }
+
+  if ((out = malloc(768 * bpp)) == NULL)
+  {
+    fputs("DEBUG: Unable to allocate memory!\n", stderr);
+    fclose(fp);
+    free(in);
+    return (1);
+  }
 
   if (bpp > 1)
-    rgb = malloc(768 * 3);
+  {
+    if ((rgb = malloc(768 * 3)) == NULL)
+    {
+      fputs("DEBUG: Unable to allocate memory!\n", stderr);
+      fclose(fp);
+      free(in);
+      free(out);
+      return (1);
+    }
+  }
   else
     rgb = NULL;
 
@@ -141,6 +163,9 @@ _cupsImageReadPhotoCD(
       free(in);
       free(out);
 
+      if (bpp > 1)
+        free(rgb);
+
       return (-1);
     }
 
diff -up cups-1.3.5/filter/image-sgilib.c.1.3.x cups-1.3.5/filter/image-sgilib.c
--- cups-1.3.5/filter/image-sgilib.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/filter/image-sgilib.c	2008-02-14 13:03:30.000000000 +0000
@@ -4,7 +4,7 @@
  *   SGI image file format library routines for the Common UNIX Printing
  *   System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1993-2005 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -250,8 +250,20 @@ sgiOpenFile(FILE *file,			/* I - File to
 
           fseek(sgip->file, 512, SEEK_SET);
 
-          sgip->table    = calloc(sgip->zsize, sizeof(long *));
-          sgip->table[0] = calloc(sgip->ysize * sgip->zsize, sizeof(long));
+          if ((sgip->table = calloc(sgip->zsize, sizeof(long *))) == NULL)
+	  {
+	    free(sgip);
+	    return (NULL);
+	  }
+
+          if ((sgip->table[0] = calloc(sgip->ysize * sgip->zsize,
+	                               sizeof(long))) == NULL)
+          {
+	    free(sgip->table);
+	    free(sgip);
+	    return (NULL);
+	  }
+
           for (i = 1; i < sgip->zsize; i ++)
             sgip->table[i] = sgip->table[0] + i * sgip->ysize;
 
@@ -333,12 +345,39 @@ sgiOpenFile(FILE *file,			/* I - File to
 
               sgip->firstrow = ftell(sgip->file);
               sgip->nextrow  = ftell(sgip->file);
-              sgip->table    = calloc(sgip->zsize, sizeof(long *));
-              sgip->table[0] = calloc(sgip->ysize * sgip->zsize, sizeof(long));
+              if ((sgip->table = calloc(sgip->zsize, sizeof(long *))) == NULL)
+	      {
+	        free(sgip);
+		return (NULL);
+	      }
+
+              if ((sgip->table[0] = calloc(sgip->ysize * sgip->zsize,
+	                                   sizeof(long))) == NULL)
+              {
+	        free(sgip->table);
+		free(sgip);
+		return (NULL);
+	      }
+
               for (i = 1; i < sgip->zsize; i ++)
         	sgip->table[i] = sgip->table[0] + i * sgip->ysize;
-              sgip->length    = calloc(sgip->zsize, sizeof(long *));
-              sgip->length[0] = calloc(sgip->ysize * sgip->zsize, sizeof(long));
+
+              if ((sgip->length = calloc(sgip->zsize, sizeof(long *))) == NULL)
+	      {
+	        free(sgip->table);
+		free(sgip);
+		return (NULL);
+	      }
+
+              if ((sgip->length[0] = calloc(sgip->ysize * sgip->zsize,
+	                                    sizeof(long))) == NULL)
+              {
+	        free(sgip->length);
+		free(sgip->table);
+		free(sgip);
+		return (NULL);
+	      }
+
               for (i = 1; i < sgip->zsize; i ++)
         	sgip->length[i] = sgip->length[0] + i * sgip->ysize;
               break;
diff -up cups-1.3.5/filter/interpret.c.1.3.x cups-1.3.5/filter/interpret.c
--- cups-1.3.5/filter/interpret.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/filter/interpret.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   PPD command interpreter for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1993-2007 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -571,7 +571,7 @@ _cupsRasterExecPS(
           break;
     }
 
-    if (obj->type == CUPS_PS_OTHER)
+    if (obj && obj->type == CUPS_PS_OTHER)
       break;
   }
 
diff -up cups-1.3.5/filter/image-sun.c.1.3.x cups-1.3.5/filter/image-sun.c
--- cups-1.3.5/filter/image-sun.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/filter/image-sun.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Sun Raster image file routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1993-2007 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -152,9 +152,32 @@ _cupsImageReadSunRaster(
     in = malloc(img->xsize * 3 + 1);
   }
 
-  bpp       = cupsImageGetDepth(img);
-  out       = malloc(img->xsize * bpp);
-  scanline  = malloc(scanwidth);
+  if (!in)
+  {
+    fputs("DEBUG: Unable to allocate memory!\n", stderr);
+    fclose(fp);
+    return (1);
+  }
+
+  bpp = cupsImageGetDepth(img);
+
+  if ((out = malloc(img->xsize * bpp)) == NULL)
+  {
+    fputs("DEBUG: Unable to allocate memory!\n", stderr);
+    fclose(fp);
+    free(in);
+    return (1);
+  }
+
+  if ((scanline = malloc(scanwidth)) == NULL)
+  {
+    fputs("DEBUG: Unable to allocate memory!\n", stderr);
+    fclose(fp);
+    free(in);
+    free(out);
+    return (1);
+  }
+
   run_count = 0;
   run_value = 0;
 
diff -up cups-1.3.5/filter/rastertoepson.c.1.3.x cups-1.3.5/filter/rastertoepson.c
--- cups-1.3.5/filter/rastertoepson.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/filter/rastertoepson.c	2008-02-14 13:03:30.000000000 +0000
@@ -4,7 +4,7 @@
  *   EPSON ESC/P and ESC/P2 filter for the Common UNIX Printing System
  *   (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1993-2007 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -153,7 +153,7 @@ StartPage(const ppd_file_t         *ppd,
   * Send a reset sequence.
   */
 
-  if (ppd->nickname && strstr(ppd->nickname, "OKIDATA") != NULL)
+  if (ppd && ppd->nickname && strstr(ppd->nickname, "OKIDATA") != NULL)
     printf("\033{A");	/* Set EPSON emulation mode */
 
   printf("\033@");
@@ -164,7 +164,7 @@ StartPage(const ppd_file_t         *ppd,
 
   EjectPage = header->Margins[0] || header->Margins[1];
     
-  switch (ppd->model_number)
+  switch (Model)
   {
     case EPSON_9PIN :
     case EPSON_24PIN :
@@ -196,7 +196,7 @@ StartPage(const ppd_file_t         *ppd,
 	DotColumns = header->HWResolution[0] / 60;
         Shingling  = 0;
 
-        if (ppd->model_number == EPSON_9PIN)
+        if (Model == EPSON_9PIN)
 	  printf("\033\063\030");	/* Set line feed */
 	else
 	  switch (header->HWResolution[0])
@@ -251,8 +251,11 @@ StartPage(const ppd_file_t         *ppd,
 	putchar(n);
 	putchar(n >> 8);
 
-	t = (ppd->sizes[1].length - ppd->sizes[1].top) *
-	    header->HWResolution[1] / 72.0;
+        if (ppd)
+	  t = (ppd->sizes[1].length - ppd->sizes[1].top) *
+	      header->HWResolution[1] / 72.0;
+        else
+	  t = 0;
 
 	pwrite("\033(c\004\000", 5);		/* Top & bottom margins */
 	putchar(t);
@@ -293,18 +296,35 @@ StartPage(const ppd_file_t         *ppd,
   * Allocate memory for a line/row of graphics...
   */
 
-  Planes[0] = malloc(header->cupsBytesPerLine);
+  if ((Planes[0] = malloc(header->cupsBytesPerLine)) == NULL)
+  {
+    fputs("ERROR: Unable to allocate memory!\n", stderr);
+    exit(1);
+  }
+
   for (plane = 1; plane < NumPlanes; plane ++)
     Planes[plane] = Planes[0] + plane * header->cupsBytesPerLine / NumPlanes;
 
   if (header->cupsCompression || DotBytes)
-    CompBuffer = calloc(2, header->cupsWidth);
+  {
+    if ((CompBuffer = calloc(2, header->cupsWidth)) == NULL)
+    {
+      fputs("ERROR: Unable to allocate memory!\n", stderr);
+      exit(1);
+    }
+  }
   else
     CompBuffer = NULL;
 
   if (DotBytes)
   {
-    LineBuffers[0] = calloc(DotBytes, header->cupsWidth * (Shingling + 1));
+    if ((LineBuffers[0] = calloc(DotBytes,
+                                 header->cupsWidth * (Shingling + 1))) == NULL)
+    {
+      fputs("ERROR: Unable to allocate memory!\n", stderr);
+      exit(1);
+    }
+
     LineBuffers[1] = LineBuffers[0] + DotBytes * header->cupsWidth;
     DotBit         = 128;
     LineCount      = 0;
diff -up cups-1.3.5/filter/image-sgi.c.1.3.x cups-1.3.5/filter/image-sgi.c
--- cups-1.3.5/filter/image-sgi.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/filter/image-sgi.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   SGI image file routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1993-2007 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -77,7 +77,6 @@ _cupsImageReadSGI(
     fprintf(stderr, "DEBUG: Bad SGI image dimensions %ux%ux%u!\n",
             sgip->xsize, sgip->ysize, sgip->zsize);
     sgiClose(sgip);
-    fclose(fp);
     return (1);
   }
 
@@ -92,10 +91,32 @@ _cupsImageReadSGI(
   cupsImageSetMaxTiles(img, 0);
 
   bpp = cupsImageGetDepth(img);
-  in  = malloc(img->xsize * sgip->zsize);
-  out = malloc(img->xsize * bpp);
 
-  rows[0] = calloc(img->xsize * sgip->zsize, sizeof(unsigned short));
+  if ((in = malloc(img->xsize * sgip->zsize)) == NULL)
+  {
+    fputs("DEBUG: Unable to allocate memory!\n", stderr);
+    sgiClose(sgip);
+    return (1);
+  }
+
+  if ((out = malloc(img->xsize * bpp)) == NULL)
+  {
+    fputs("DEBUG: Unable to allocate memory!\n", stderr);
+    sgiClose(sgip);
+    free(in);
+    return (1);
+  }
+
+  if ((rows[0] = calloc(img->xsize * sgip->zsize,
+                        sizeof(unsigned short))) == NULL)
+  {
+    fputs("DEBUG: Unable to allocate memory!\n", stderr);
+    sgiClose(sgip);
+    free(in);
+    free(out);
+    return (1);
+  }
+
   for (i = 1; i < sgip->zsize; i ++)
     rows[i] = rows[0] + i * img->xsize;
 
diff -up cups-1.3.5/filter/image-pnm.c.1.3.x cups-1.3.5/filter/image-pnm.c
--- cups-1.3.5/filter/image-pnm.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/filter/image-pnm.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Portable Any Map file routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1993-2007 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -67,7 +67,13 @@ _cupsImageReadPNM(
   *   max sample
   */
 
-  lineptr = fgets(line, sizeof(line), fp);
+  if ((lineptr = fgets(line, sizeof(line), fp)) == NULL)
+  {
+    fputs("DEBUG: Bad PNM header!\n", stderr);
+    fclose(fp);
+    return (1);
+  }
+
   lineptr ++;
 
   format = atoi(lineptr);
@@ -147,8 +153,21 @@ _cupsImageReadPNM(
   cupsImageSetMaxTiles(img, 0);
 
   bpp = cupsImageGetDepth(img);
-  in  = malloc(img->xsize * 3);
-  out = malloc(img->xsize * bpp);
+
+  if ((in = malloc(img->xsize * 3)) == NULL)
+  {
+    fputs("DEBUG: Unable to allocate memory!\n", stderr);
+    fclose(fp);
+    return (1);
+  }
+
+  if ((out = malloc(img->xsize * bpp)) == NULL)
+  {
+    fputs("DEBUG: Unable to allocate memory!\n", stderr);
+    fclose(fp);
+    free(in);
+    return (1);
+  }
 
  /*
   * Read the image file...
diff -up cups-1.3.5/filter/hpgl-input.c.1.3.x cups-1.3.5/filter/hpgl-input.c
--- cups-1.3.5/filter/hpgl-input.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/filter/hpgl-input.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   HP-GL/2 input processing for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1993-2006 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -48,6 +48,7 @@ ParseCommand(FILE    *fp,	/* I - File to
 		i;		/* Looping var */
   char		buf[262144],	/* String buffer */
 		*bufptr;	/* Pointer into buffer */
+  float		temp;		/* Temporary parameter value */
   static param_t p[MAX_PARAMS];	/* Parameter buffer */
 
 
@@ -212,10 +213,10 @@ ParseCommand(FILE    *fp,	/* I - File to
       case '-' :
       case '+' :
           ungetc(ch, fp);
-          fscanf(fp, "%f", &(p[num_params].value.number));
-          if (num_params < MAX_PARAMS)
+          if (fscanf(fp, "%f", &temp) == 1 && num_params < MAX_PARAMS)
           {
-            p[num_params].type = PARAM_RELATIVE;
+            p[num_params].type         = PARAM_RELATIVE;
+            p[num_params].value.number = temp;
             num_params ++;
           }
           break;
@@ -231,10 +232,10 @@ ParseCommand(FILE    *fp,	/* I - File to
       case '9' :
       case '.' :
           ungetc(ch, fp);
-          fscanf(fp, "%f", &(p[num_params].value.number));
-          if (num_params < MAX_PARAMS)
+          if (fscanf(fp, "%f", &temp) == 1 && num_params < MAX_PARAMS)
           {
-            p[num_params].type = PARAM_ABSOLUTE;
+            p[num_params].type         = PARAM_ABSOLUTE;
+            p[num_params].value.number = temp;
             num_params ++;
           }
           break;
diff -up cups-1.3.5/filter/image-bmp.c.1.3.x cups-1.3.5/filter/image-bmp.c
--- cups-1.3.5/filter/image-bmp.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/filter/image-bmp.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   BMP image routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1993-2007 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -179,9 +179,22 @@ _cupsImageReadBMP(
 
   cupsImageSetMaxTiles(img, 0);
 
-  in  = malloc(img->xsize * 3);
   bpp = cupsImageGetDepth(img);
-  out = malloc(img->xsize * bpp);
+
+  if ((in = malloc(img->xsize * 3)) == NULL)
+  {
+    fputs("DEBUG: Unable to allocate memory!\n", stderr);
+    fclose(fp);
+    return (1);
+  }
+
+  if ((out = malloc(img->xsize * bpp)) == NULL)
+  {
+    fputs("DEBUG: Unable to allocate memory!\n", stderr);
+    free(in);
+    fclose(fp);
+    return (1);
+  }
 
  /*
   * Read the image data...
diff -up cups-1.3.5/filter/image-gif.c.1.3.x cups-1.3.5/filter/image-gif.c
--- cups-1.3.5/filter/image-gif.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/filter/image-gif.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   GIF image routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1993-2007 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -462,8 +462,14 @@ gif_read_image(FILE         *fp,	/* I - 
   pass      = 0;
   code_size = getc(fp);
 
+  if (!pixels)
+    return (-1);
+
   if (gif_read_lzw(fp, 1, code_size) < 0)
+  {
+    free(pixels);
     return (-1);
+  }
 
   temp = pixels;
   while ((pixel = gif_read_lzw(fp, 0, code_size)) >= 0)
diff -up cups-1.3.5/filter/image-pix.c.1.3.x cups-1.3.5/filter/image-pix.c
--- cups-1.3.5/filter/image-pix.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/filter/image-pix.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Alias PIX image routines for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1993-2007 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -95,9 +95,22 @@ _cupsImageReadPIX(
 
   cupsImageSetMaxTiles(img, 0);
 
-  in  = malloc(img->xsize * (depth / 8));
   bpp = cupsImageGetDepth(img);
-  out = malloc(img->xsize * bpp);
+
+  if ((in = malloc(img->xsize * (depth / 8))) == NULL)
+  {
+    fputs("DEBUG: Unable to allocate memory!\n", stderr);
+    fclose(fp);
+    return (1);
+  }
+
+  if ((out = malloc(img->xsize * bpp)) == NULL)
+  {
+    fputs("DEBUG: Unable to allocate memory!\n", stderr);
+    fclose(fp);
+    free(in);
+    return (1);
+  }
 
  /*
   * Read the image data...
diff -up cups-1.3.5/filter/image.c.1.3.x cups-1.3.5/filter/image.c
--- cups-1.3.5/filter/image.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/filter/image.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   Base image support for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1993-2005 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -320,15 +320,10 @@ cupsImageOpen(
   */
 
   if ((fp = fopen(filename, "r")) == NULL)
-  {
-/*    perror("ERROR: Unable to open image file");
-*/    return (NULL);
-  }
+    return (NULL);
 
   if (fread(header, 1, sizeof(header), fp) == 0)
   {
-/*    perror("ERROR: Unable to read image file header");
-*/
     fclose(fp);
     return (NULL);
   }
@@ -346,8 +341,7 @@ cupsImageOpen(
 
   if (img == NULL)
   {
-/*    perror("ERROR: Unable to allocate memory for image file");
-*/    fclose(fp);
+    fclose(fp);
     return (NULL);
   }
 
@@ -401,8 +395,7 @@ cupsImageOpen(
 #endif /* HAVE_LIBTIFF */
   else
   {
-/*    fputs("ERROR: Unknown image file format!");
-*/    fclose(fp);
+    fclose(fp);
     status = -1;
   }
 
@@ -729,8 +722,11 @@ get_tile(cups_image_t *img,		/* I - Imag
 
     DEBUG_printf(("Creating tile array (%dx%d)\n", xtiles, ytiles));
 
-    img->tiles = calloc(sizeof(cups_itile_t *), ytiles);
-    tile       = calloc(sizeof(cups_itile_t), xtiles * ytiles);
+    if ((img->tiles = calloc(sizeof(cups_itile_t *), ytiles)) == NULL)
+      return (NULL);
+
+    if ((tile = calloc(sizeof(cups_itile_t), xtiles * ytiles)) == NULL)
+      return (NULL);
 
     for (tiley = 0; tiley < ytiles; tiley ++)
     {
@@ -751,13 +747,23 @@ get_tile(cups_image_t *img,		/* I - Imag
   {
     if (img->num_ics < img->max_ics)
     {
-      ic         = calloc(sizeof(cups_ic_t) + bpp * CUPS_TILE_SIZE *
-                                              CUPS_TILE_SIZE, 1);
-      ic->pixels = ((cups_ib_t *)ic) + sizeof(cups_ic_t);
+      if ((ic = calloc(sizeof(cups_ic_t) +
+                       bpp * CUPS_TILE_SIZE * CUPS_TILE_SIZE, 1)) == NULL)
+      {
+        if (img->num_ics == 0)
+	  return (NULL);
+
+        flush_tile(img);
+	ic = img->first;
+      }
+      else
+      {
+	ic->pixels = ((cups_ib_t *)ic) + sizeof(cups_ic_t);
 
-      img->num_ics ++;
+	img->num_ics ++;
 
-      DEBUG_printf(("Allocated cache tile %d (%p)...\n", img->num_ics, ic));
+	DEBUG_printf(("Allocated cache tile %d (%p)...\n", img->num_ics, ic));
+      }
     }
     else
     {
diff -up cups-1.3.5/filter/rastertohp.c.1.3.x cups-1.3.5/filter/rastertohp.c
--- cups-1.3.5/filter/rastertohp.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/filter/rastertohp.c	2008-02-14 13:03:30.000000000 +0000
@@ -4,7 +4,7 @@
  *   Hewlett-Packard Page Control Language filter for the Common UNIX
  *   Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1993-2007 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -277,7 +277,7 @@ StartPage(ppd_file_t         *ppd,	/* I 
   * Set graphics mode...
   */
 
-  if (ppd->model_number == 2)
+  if (ppd && ppd->model_number == 2)
   {
    /*
     * Figure out the number of color planes...
@@ -382,7 +382,12 @@ StartPage(ppd_file_t         *ppd,	/* I 
   * Allocate memory for a line of graphics...
   */
 
-  Planes[0] = malloc(header->cupsBytesPerLine);
+  if ((Planes[0] = malloc(header->cupsBytesPerLine)) == NULL)
+  {
+    fputs("ERROR: Unable to allocate memory!\n", stderr);
+    exit(1);
+  }
+
   for (plane = 1; plane < NumPlanes; plane ++)
     Planes[plane] = Planes[0] + plane * header->cupsBytesPerLine / NumPlanes;
 
diff -up cups-1.3.5/config.h.in.1.3.x cups-1.3.5/config.h.in
--- cups-1.3.5/config.h.in.1.3.x	2007-08-29 18:22:26.000000000 +0100
+++ cups-1.3.5/config.h.in	2008-02-14 13:03:30.000000000 +0000
@@ -77,13 +77,6 @@
 
 
 /*
- * Maximum number of file descriptors to support.
- */
-
-#define CUPS_MAX_FDS		4096
-
-
-/*
  * Do we have domain socket support?
  */
 
@@ -446,13 +439,6 @@
 
 
 /*
- * Do we have CFLocaleCreateCanonicalLocaleIdentifierFromString()?
- */
-
-#undef HAVE_CF_LOCALE_ID
-
-
-/*
  * Do we have MacOSX 10.4's mbr_XXX functions()?
  */
 
diff -up cups-1.3.5/Makedefs.in.1.3.x cups-1.3.5/Makedefs.in
--- cups-1.3.5/Makedefs.in.1.3.x	2007-10-10 23:50:07.000000000 +0100
+++ cups-1.3.5/Makedefs.in	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
 #
 #   Common makefile definitions for the Common UNIX Printing System (CUPS).
 #
-#   Copyright 2007 by Apple Inc.
+#   Copyright 2007-2008 by Apple Inc.
 #   Copyright 1997-2007 by Easy Software Products, all rights reserved.
 #
 #   These coded instructions, statements, and computer programs are the
@@ -108,17 +108,17 @@ INSTALLSTATIC	=	@INSTALLSTATIC@
 #               for extra debug info)
 #
 
-ALL_CFLAGS	=	$(CFLAGS) $(SSLFLAGS) @LARGEFILE@ @PTHREAD_FLAGS@ \
-			$(OPTIONS)
+ALL_CFLAGS	=	-I.. -D_CUPS_SOURCE $(CFLAGS) $(SSLFLAGS) \
+			@LARGEFILE@ @PTHREAD_FLAGS@ $(OPTIONS)
+ALL_CXXFLAGS	=	-I.. -D_CUPS_SOURCE $(CXXFLAGS) $(SSLFLAGS) \
+			@LARGEFILE@ @PTHREAD_FLAGS@ $(OPTIONS)
 ARCHFLAGS	=	@ARCHFLAGS@
 ARFLAGS		=	@ARFLAGS@
 BACKLIBS	=	@BACKLIBS@
-CFLAGS		=	-I.. @CPPFLAGS@ @CFLAGS@ \
-			@LARGEFILE@ @PTHREAD_FLAGS@ $(OPTIONS)
+CFLAGS		=	@CPPFLAGS@ @CFLAGS@
 COMMONLIBS	=	@LIBS@
 CUPSDLIBS	=	@CUPSDLIBS@
-CXXFLAGS	=	-I.. $(SSLFLAGS) @CPPFLAGS@ @CXXFLAGS@ \
-			@LARGEFILE@ @PTHREAD_FLAGS@ $(OPTIONS)
+CXXFLAGS	=	@CPPFLAGS@ @CXXFLAGS@
 CXXLIBS		=	@CXXLIBS@
 DSOFLAGS	=	@DSOFLAGS@
 DSOLIBS		=	@DSOLIBS@ $(COMMONLIBS)
@@ -258,7 +258,7 @@ DBUSDIR		=	@DBUSDIR@
 
 .cxx.o:
 	echo Compiling $<...
-	$(CXX) $(ARCHFLAGS) $(OPTIM) $(CXXFLAGS) -c $<
+	$(CXX) $(ARCHFLAGS) $(OPTIM) $(ALL_CXXFLAGS) -c $<
 
 .man.1 .man.1m .man.5 .man.7 .man.8:
 	echo Linking $<...
diff -up cups-1.3.5/doc/index.html.in.1.3.x cups-1.3.5/doc/index.html.in
--- cups-1.3.5/doc/index.html.in.1.3.x	2007-12-07 18:37:40.000000000 +0000
+++ cups-1.3.5/doc/index.html.in	2008-02-14 13:03:30.000000000 +0000
@@ -112,9 +112,9 @@ assistance:</P>
 WIDTH="15" HEIGHT="15" ALT=""></TD>
 <TD COLSPAN="2" WIDTH="100%" STYLE="padding: 5;">
 
-<P><SMALL>The Common UNIX Printing System, CUPS, and the CUPS logo are the
-trademark property of <A HREF="http://www.apple.com">Apple Inc.</A>
-CUPS is copyright 2007 by Apple Inc., All Rights Reserved.</SMALL></P>
+<P><SMALL>The Common UNIX Printing System, CUPS, and the CUPS logo are
+trademarks of <A HREF="http://www.apple.com">Apple Inc.</A> CUPS is
+copyright 2007-2008 Apple Inc. All rights reserved.</SMALL></P>
 
 </TD>
 
diff -up cups-1.3.5/doc/help/spec-ppd.html.1.3.x cups-1.3.5/doc/help/spec-ppd.html
--- cups-1.3.5/doc/help/spec-ppd.html.1.3.x	2007-10-31 18:35:56.000000000 +0000
+++ cups-1.3.5/doc/help/spec-ppd.html	2008-02-14 13:03:30.000000000 +0000
@@ -1204,7 +1204,7 @@ list of locale names ("en", "en_US", "fr
 
 <pre class='command'>
 <em>*% Specify Canadian, UK, and US English, and Candian and French French</em> 
-*cupsLanguages: "en_CA en_UK en_US fr_CA fr_CA"
+*cupsLanguages: "en_CA en_UK en_US fr_CA fr_FR"
 </pre>
 
 <h3><a name='cupsManualCopies'>cupsManualCopies</a></h3>
diff -up cups-1.3.5/doc/help/spec-ipp.html.1.3.x cups-1.3.5/doc/help/spec-ipp.html
--- cups-1.3.5/doc/help/spec-ipp.html.1.3.x	2007-07-12 23:58:17.000000000 +0100
+++ cups-1.3.5/doc/help/spec-ipp.html	2008-02-14 13:03:30.000000000 +0000
@@ -11,7 +11,7 @@
 
   CUPS IPP specification for the Common UNIX Printing System (CUPS).
 
-  Copyright 2007 by Apple Inc.
+  Copyright 2007-2008 by Apple Inc.
   Copyright 1997-2007 by Easy Software Products.
 
   These coded instructions, statements, and computer programs are the
@@ -2251,6 +2251,101 @@ the system.
 <p>The job-sheets-supported attribute specifies the available banner files.
 There will always be at least one banner file available called "none".
 
+<h4><a name="marker-change-time">marker-change-time (integer)</a></h4>
+
+<p>The marker-change-time attribute specifies the printer-up-time value when
+the last change to the marker-colors, marker-levels, marker-names, or
+marker-types attributes was made.</p>
+
+<h4><a name="marker-colors">marker-colors (1setof name(MAX))</a></h4>
+
+<p>The marker-colors attribute specifies the color(s) for each supply in the
+printer. It is only available when the driver provides supply levels. The
+color is either "none" or one or more hex-encoded sRGB colors of the form
+"#RRGGBB".</p>
+
+<h4><a name="marker-levels">marker-levels (1setof integer(-1:100))</a></h4>
+
+<p>The marker-levels attribute specifies the current supply levels for the
+printer. It is only available when the driver provides supply levels. A
+value of -1 indicates the level is unknown, while values from 0 to 100
+indicate the corresponding percentage.</p>
+
+<h4><a name="marker-names">marker-names (1setof name(MAX))</a></h4>
+
+<p>The marker-names attribute specifies the name(s) for each supply in the
+printer. It is only available when the driver provides supply levels.</p>
+
+<h4><a name="marker-types">marker-types (1setof type3 keyword)</a></h4>
+
+<p>The marker-types attribute specifies the type(s) of each supply in the
+printer. It is only available when the driver provides supply levels. The
+following (RFC 3805) types are currently supported:</p>
+
+<ul>
+
+	<li><tt>toner</tt></li>
+
+	<li><tt>wasteToner</tt></li>
+
+	<li><tt>ink</tt></li>
+
+	<li><tt>inkCartridge</tt></li>
+
+	<li><tt>inkRibbon</tt></li>
+
+	<li><tt>wasteInk</tt></li>
+
+	<li><tt>opc</tt></li>
+
+	<li><tt>developer</tt></li>
+
+	<li><tt>fuserOil</tt></li>
+
+	<li><tt>solidWax</tt></li>
+
+	<li><tt>ribbonWax</tt></li>
+
+	<li><tt>wasteWax</tt></li>
+
+	<li><tt>fuser</tt></li>
+
+	<li><tt>coronaWire</tt></li>
+
+	<li><tt>fuserOilWick</tt></li>
+
+	<li><tt>cleanerUnit</tt></li>
+
+	<li><tt>fuserCleaningPad</tt></li>
+
+	<li><tt>transferUnit</tt></li>
+
+	<li><tt>tonerCartridge</tt></li>
+
+	<li><tt>fuserOiler</tt></li>
+
+	<li><tt>water</tt></li>
+
+	<li><tt>wasteWater</tt></li>
+
+	<li><tt>bindingSupply</tt></li>
+
+	<li><tt>bandingSupply</tt></li>
+
+	<li><tt>stichingWire</tt></li>
+
+	<li><tt>shrinkWrap</tt></li>
+
+	<li><tt>paperWrap</tt></li>
+
+	<li><tt>staples</tt></li>
+
+	<li><tt>inserts</tt></li>
+
+	<li><tt>covers</tt></li>
+
+</ul>
+
 <h4><a name="port-monitor">port-monitor" (name(127))</a></h4>
 
 <p>The port-monitor attribute specifies the port monitor to use when printing
diff -up cups-1.3.5/systemv/cupstestppd.c.1.3.x cups-1.3.5/systemv/cupstestppd.c
--- cups-1.3.5/systemv/cupstestppd.c.1.3.x	2007-11-27 00:09:24.000000000 +0000
+++ cups-1.3.5/systemv/cupstestppd.c	2008-02-14 13:03:30.000000000 +0000
@@ -3,7 +3,7 @@
  *
  *   PPD test program for the Common UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -2010,8 +2010,10 @@ check_translations(ppd_file_t *ppd,	/* I
     * This file contains localizations, check them...
     */
 
-    languages = strdup(attr->value);
-    langlist  = cupsArrayNew((cups_array_func_t)strcmp, NULL);
+    if ((languages = strdup(attr->value)) == NULL)
+      return (1);
+
+    langlist = cupsArrayNew((cups_array_func_t)strcmp, NULL);
 
     for (langptr = languages; *langptr;)
     {
diff -up cups-1.3.5/systemv/lpmove.c.1.3.x cups-1.3.5/systemv/lpmove.c
--- cups-1.3.5/systemv/lpmove.c.1.3.x	2007-11-27 00:09:24.000000000 +0000
+++ cups-1.3.5/systemv/lpmove.c	2008-02-14 13:03:30.000000000 +0000
@@ -61,7 +61,6 @@ main(int  argc,				/* I - Number of comm
 
   dest      = NULL;
   dests     = NULL;
-  http      = NULL;
   job       = NULL;
   jobid     = 0;
   num_dests = 0;
@@ -75,8 +74,6 @@ main(int  argc,				/* I - Number of comm
 #ifdef HAVE_SSL
 	    cupsSetEncryption(HTTP_ENCRYPT_REQUIRED);
 
-	    if (http)
-	      httpEncryption(http, HTTP_ENCRYPT_REQUIRED);
 #else
             _cupsLangPrintf(stderr,
 	                    _("%s: Sorry, no encryption support compiled in!\n"),
@@ -85,12 +82,6 @@ main(int  argc,				/* I - Number of comm
 	    break;
 
         case 'h' : /* Connect to host */
-	    if (http)
-	    {
-	      httpClose(http);
-	      http = NULL;
-	    }
-
 	    if (argv[i][2] != '\0')
 	      cupsSetServer(argv[i] + 2);
 	    else
@@ -142,17 +133,14 @@ main(int  argc,				/* I - Number of comm
     return (1);
   }
 
-  if (!http)
-  {
-    http = httpConnectEncrypt(cupsServer(), ippPort(), cupsEncryption());
+  http = httpConnectEncrypt(cupsServer(), ippPort(), cupsEncryption());
 
-    if (http == NULL)
-    {
-      _cupsLangPrintf(stderr,
-                      _("lpmove: Unable to connect to server: %s\n"),
-		      strerror(errno));
-      return (1);
-    }
+  if (http == NULL)
+  {
+    _cupsLangPrintf(stderr,
+		    _("lpmove: Unable to connect to server: %s\n"),
+		    strerror(errno));
+    return (1);
   }
 
   return (move_job(http, src, jobid, dest));
diff -up cups-1.3.5/systemv/accept.c.1.3.x cups-1.3.5/systemv/accept.c
--- cups-1.3.5/systemv/accept.c.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/systemv/accept.c	2008-02-14 13:03:30.000000000 +0000
@@ -4,7 +4,7 @@
  *   "accept", "disable", "enable", and "reject" commands for the Common
  *   UNIX Printing System (CUPS).
  *
- *   Copyright 2007 by Apple Inc.
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1997-2006 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
@@ -125,8 +125,11 @@ main(int  argc,				/* I - Number of comm
 	    break;
 
         case 'h' : /* Connect to host */
-	    if (http != NULL)
+	    if (http)
+	    {
 	      httpClose(http);
+	      http = NULL;
+	    }
 
 	    if (argv[i][2] != '\0')
 	      cupsSetServer(argv[i] + 2);
diff -up cups-1.3.5/README.txt.1.3.x cups-1.3.5/README.txt
--- cups-1.3.5/README.txt.1.3.x	2007-09-18 21:39:31.000000000 +0100
+++ cups-1.3.5/README.txt	2008-02-14 13:03:30.000000000 +0000
@@ -1,4 +1,4 @@
-README - CUPS v1.3.2 - 2007-09-18
+README - CUPS v1.3.6 - 2008-01-22
 ---------------------------------
 
 Looking for compile instructions?  Read the file "INSTALL.txt"
@@ -153,9 +153,9 @@ PRINTING FILES
 
 LEGAL STUFF
 
-    CUPS is Copyright 2007 by Apple Inc.  CUPS, the CUPS logo, and
-    the Common UNIX Printing System are the trademark property of
-    Apple Inc.
+    CUPS is Copyright 2007-2008 by Apple Inc.  CUPS, the CUPS logo,
+    and the Common UNIX Printing System are the trademark property
+    of Apple Inc.
 
     The MD5 Digest code is Copyright 1999 Aladdin Enterprises.
 
diff -up cups-1.3.5/data/testprint.ps.1.3.x cups-1.3.5/data/testprint.ps
--- cups-1.3.5/data/testprint.ps.1.3.x	2007-07-11 22:46:42.000000000 +0100
+++ cups-1.3.5/data/testprint.ps	2008-02-14 13:03:30.000000000 +0000
@@ -14,7 +14,7 @@
 %
 %   PostScript test page for the Common UNIX Printing System ("CUPS").
 %
-%   Copyright 2007 Apple Inc.
+%   Copyright 2007-2008 Apple Inc.
 %   Copyright 1993-2007 Easy Software Products
 %
 %   These coded instructions, statements, and computer programs are the
@@ -573,10 +573,10 @@ gsave
   pageHeight 8 mul			% Move down...
   2 copy moveto				% Position text
   smallFont setfont			% Font
-  (Copyright 2007 Apple Inc., All Rights Reserved. CUPS and the CUPS logo are the trademark) show
+  (Copyright 2007-2008 Apple Inc., All Rights Reserved. CUPS and the CUPS logo are the) show
   pageHeight 2 add sub			% Move down...
   2 copy moveto				% Position text
-  (property of Apple Inc., 1 Infinite Loop, Cupertino, CA 95014, USA.) show
+  (trademark property of Apple Inc., 1 Infinite Loop, Cupertino, CA 95014, USA.) show
   pageHeight 2 mul 4 add sub		% Move down...
   moveto				% Position text
   (Need help? Contact your operating system vendor or visit "http://www.cups.org/".) show