diff --git a/cups-str3448.patch b/cups-str3448.patch
new file mode 100644
index 0000000..4233e7e
--- /dev/null
+++ b/cups-str3448.patch
@@ -0,0 +1,16 @@
+diff -up cups-1.4.2/cups/dest.c.str3448 cups-1.4.2/cups/dest.c
+--- cups-1.4.2/cups/dest.c.str3448	2009-08-28 23:54:34.000000000 +0100
++++ cups-1.4.2/cups/dest.c	2009-12-10 18:15:50.910079549 +0000
+@@ -145,6 +145,12 @@ cupsAddDest(const char  *name,		/* I  - 
+ 
+     dest = cups_add_dest(name, instance, &num_dests, dests);
+ 
++   /*
++    * Find the base dest again now the array has been realloc'd.
++    */
++
++    parent = cupsGetDest(name, NULL, num_dests, *dests);
++
+     if (instance && parent && parent->num_options > 0)
+     {
+      /*
diff --git a/cups.spec b/cups.spec
index 11fba43..fc45a1a 100644
--- a/cups.spec
+++ b/cups.spec
@@ -9,7 +9,7 @@
 Summary: Common Unix Printing System
 Name: cups
 Version: 1.4.2
-Release: 15%{?dist}
+Release: 16%{?dist}
 License: GPLv2
 Group: System Environment/Daemons
 Source: http://ftp.easysw.com/pub/cups/%{version}/cups-%{version}-source.tar.bz2
@@ -32,6 +32,7 @@ Patch4: cups-serial.patch
 Patch5: cups-banners.patch
 Patch6: cups-serverbin-compat.patch
 Patch7: cups-no-export-ssllibs.patch
+Patch8: cups-str3448.patch
 Patch9: cups-direct-usb.patch
 Patch10: cups-lpr-help.patch
 Patch11: cups-peercred.patch
@@ -210,6 +211,7 @@ module.
 %patch5 -p1 -b .banners
 %patch6 -p1 -b .serverbin-compat
 %patch7 -p1 -b .no-export-ssllibs
+%patch8 -p1 -b .str3448
 %patch9 -p1 -b .direct-usb
 %patch10 -p1 -b .lpr-help
 %patch11 -p1 -b .peercred
@@ -549,6 +551,9 @@ rm -rf $RPM_BUILD_ROOT
 %{php_extdir}/phpcups.so
 
 %changelog
+* Thu Dec 10 2009 Tim Waugh <twaugh@redhat.com> - 1:1.4.2-16
+- Fixed invalid read in cupsAddDest (bug #547460).
+
 * Wed Dec  9 2009 Tim Waugh <twaugh@redhat.com> - 1:1.4.2-15
 - Use upstream patch to fix scheduler crash when an active printer was
   deleted (rev 8914).