Range check cached SNMP supply level info (Issue #1538)

Author: michaelrsweet

CHANGES.md

@@ -166,6 +166,7 @@ v2.5b1 - YYYY-MM-DD
 - Fixed error recovery when scanning for PPDs in `cups-driverd` (Issue #1416)
 - Fixed allowed values for directive `FilterNice`
 - Fixed an allocation bug in the `rastertoepson` filter (Issue #1537)
+- Fixed a range check when loading cached SNMP supply information (Issue #1538)
 - Removed hash support for SHA2-512-224 and SHA2-512-256.
 - Removed `mantohtml` script for generating html pages (use
   `https://www.msweet.org/mantohtml/`)

backend/snmp-supplies.c

@@ -1,7 +1,7 @@
 /*
  * SNMP supplies functions for CUPS.
  *
- * Copyright © 2020-2024 by OpenPrinting.
+ * Copyright © 2020-2026 by OpenPrinting.
  * Copyright © 2008-2015 by Apple Inc.
  *
  * Licensed under Apache License v2.0.  See the file "LICENSE" for more
@@ -575,7 +575,7 @@ backend_init_supplies(
     if (cupsFileGets(cachefile, value, sizeof(value)))
     {
       if (sscanf(value, "3 %d%d", &num_supplies, &charset) == 2 &&
-          num_supplies <= CUPS_MAX_SUPPLIES &&
+          num_supplies > 0 && num_supplies <= CUPS_MAX_SUPPLIES &&
           cupsFileGets(cachefile, value, sizeof(value)))
       {
         if (!strcmp(description, value))