]> git.ipfire.org Git - thirdparty/cups.git/commitdiff
Ensure that cupsBytesPerLine < 2^31 for 32-bit only platforms
authormsweet <msweet@a1ca3aef-8c08-0410-bb20-df032aa958be>
Fri, 23 Oct 2015 20:30:33 +0000 (20:30 +0000)
committermsweet <msweet@a1ca3aef-8c08-0410-bb20-df032aa958be>
Fri, 23 Oct 2015 20:30:33 +0000 (20:30 +0000)
(<rdar://problem/23133393>)

git-svn-id: svn+ssh://src.apple.com/svn/cups/cups.org/trunk@12923 a1ca3aef-8c08-0410-bb20-df032aa958be

CHANGES-2.1.txt
filter/raster.c

index dd85cf55bdc85af34ebb57386aad50da1095cf35..41de655a486197a0ed7d7f202e87fe7f5058ccc3 100644 (file)
@@ -5,7 +5,8 @@ CHANGES IN CUPS V2.1.1
 
        - Security hardening fixes (<rdar://problem/23131948>,
          <rdar://problem/23132108>, <rdar://problem/23132353>,
-         <rdar://problem/23132803>, <rdar://problem/23133230>)
+         <rdar://problem/23132803>, <rdar://problem/23133230>,
+         <rdar://problem/23133393>)
        - The cupsGetPPD* functions did not work with IPP printers (STR #4725)
        - Some older HP LaserJet printers need a delayed close when printing
          using the libusb-based USB backend (STR #4549)
index 879012fd455b1a0e6451313be6714eba04c82d9c..eff266e9b6faa199aae24a424774edf5b094ceb4 100644 (file)
@@ -1022,7 +1022,7 @@ cups_raster_read_header(
 
   DEBUG_printf(("4cups_raster_read_header: cupsBitsPerPixel=%u, cupsBitsPerColor=%u, cupsBytesPerLine=%u, cupsWidth=%u, cupsHeight=%u, r->bpp=%d", r->header.cupsBitsPerPixel, r->header.cupsBitsPerColor, r->header.cupsBytesPerLine, r->header.cupsWidth, r->header.cupsHeight, r->bpp));
 
-  return (r->header.cupsBitsPerPixel > 0 && r->header.cupsBitsPerPixel <= 240 && r->header.cupsBitsPerColor > 0 && r->header.cupsBitsPerColor <= 16 && r->header.cupsBytesPerLine != 0 && r->header.cupsHeight != 0 && (r->header.cupsBytesPerLine % r->bpp) == 0);
+  return (r->header.cupsBitsPerPixel > 0 && r->header.cupsBitsPerPixel <= 240 && r->header.cupsBitsPerColor > 0 && r->header.cupsBitsPerColor <= 16 && r->header.cupsBytesPerLine > 0 && r->header.cupsBytesPerLine <= 0x7fffffff && r->header.cupsHeight != 0 && (r->header.cupsBytesPerLine % r->bpp) == 0);
 }