From 04a397d457ed95b29649aba681589f5ea77d7e0f Mon Sep 17 00:00:00 2001
From: millert <millert@openbsd.org>
Date: Tue, 9 Jun 2026 21:46:48 +0000
Subject: [PATCH] lpd: require data file path name to be in the spool dir

When processing the control file, any file to be printed must be
located in the spool directory (e.g. dfA000foobar) either as a
regular file or a symbolic link to another file to be printed.  This
matches the handling of the 'U' (unlink) directive.

OK deraadt@
---
 usr.sbin/lpr/lpd/printjob.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/usr.sbin/lpr/lpd/printjob.c b/usr.sbin/lpr/lpd/printjob.c
index 9b8579eff30..0cb766fa418 100644
--- a/usr.sbin/lpr/lpd/printjob.c
+++ b/usr.sbin/lpr/lpd/printjob.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: printjob.c,v 1.62 2021/10/24 21:24:18 deraadt Exp $	*/
+/*	$OpenBSD: printjob.c,v 1.63 2026/06/09 21:46:48 millert Exp $	*/
 /*	$NetBSD: printjob.c,v 1.31 2002/01/21 14:42:30 wiz Exp $	*/
 
 /*
@@ -467,6 +467,8 @@ printit(char *file)
 			continue;
 
 		default:	/* some file to print */
+			if (strchr(line+1, '/'))
+				continue;
 			switch (i = print(line[0], line+1)) {
 			case ERROR:
 				if (bombed == OK)