Fix potential buffer overflow in rastertohp (STR #4601)

[thirdparty/cups.git] / filter / rastertohp.c

diff --git a/filter/rastertohp.c b/filter/rastertohp.c
index 42d43c8f51fccde45ffdd8d0cff912e520d666f9..c7cc18122884e84c5d41b1a4493c9a73d4d274fa 100644 (file)
--- a/filter/rastertohp.c
+++ b/filter/rastertohp.c
@@ -3,7 +3,7 @@
  *
  * Hewlett-Packard Page Control Language filter for CUPS.
  *
- * Copyright 2007-2014 by Apple Inc.
+ * Copyright 2007-2015 by Apple Inc.
  * Copyright 1993-2007 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
@@ -354,7 +354,7 @@ StartPage(ppd_file_t         *ppd,  /* I - PPD file */
   * Allocate memory for a line of graphics...
   */
 
-  if ((Planes[0] = malloc(header->cupsBytesPerLine)) == NULL)
+  if ((Planes[0] = malloc(header->cupsBytesPerLine + NumPlanes)) == NULL)
   {
     fputs("ERROR: Unable to allocate memory\n", stderr);
     exit(1);
@@ -369,7 +369,7 @@ StartPage(ppd_file_t         *ppd,  /* I - PPD file */
     BitBuffer = NULL;
 
   if (header->cupsCompression)
-    CompBuffer = malloc(header->cupsBytesPerLine * 2);
+    CompBuffer = malloc(header->cupsBytesPerLine * 2 + 2);
   else
     CompBuffer = NULL;
 }