Fix another potential buffer overflow (STR #4599)

[thirdparty/cups.git] / filter / interpret.c

diff --git a/filter/interpret.c b/filter/interpret.c
index 1d8323b1f34da2e984fcf7caf147d4abd30dfdd5..380fa1d5587e2a76d882a1ddc8c7cf9cc5063dcc 100644 (file)
--- a/filter/interpret.c
+++ b/filter/interpret.c
@@ -328,6 +328,20 @@ cupsRasterInterpretPPD(
         break;
   }
 
+  if (left > right)
+  {
+    temp1 = left;
+    left  = right;
+    right = temp1;
+  }
+
+  if (bottom > top)
+  {
+    temp1  = bottom;
+    bottom = top;
+    top    = temp1;
+  }
+
   h->PageSize[0]           = (unsigned)(h->cupsPageSize[0] *
                                         h->cupsBorderlessScalingFactor);
   h->PageSize[1]           = (unsigned)(h->cupsPageSize[1] *
@@ -379,9 +393,9 @@ cupsRasterInterpretPPD(
   * Compute the bitmap parameters...
   */
 
-  h->cupsWidth  = (int)((right - left) * h->cupsBorderlessScalingFactor *
+  h->cupsWidth  = (unsigned)((right - left) * h->cupsBorderlessScalingFactor *
                         h->HWResolution[0] / 72.0f + 0.5f);
-  h->cupsHeight = (int)((top - bottom) * h->cupsBorderlessScalingFactor *
+  h->cupsHeight = (unsigned)((top - bottom) * h->cupsBorderlessScalingFactor *
                         h->HWResolution[1] / 72.0f + 0.5f);
 
   switch (h->cupsColorSpace)
@@ -497,6 +511,7 @@ _cupsRasterExecPS(
     int                 *preferred_bits,/* O - Preferred bits per color */
     const char          *code)         /* I - PS code to execute */
 {
+  int                  error = 0;      /* Error condition? */
   _cups_ps_stack_t     *st;            /* PostScript value stack */
   _cups_ps_obj_t       *obj;           /* Object from top of stack */
   char                 *codecopy,      /* Copy of code */
@@ -504,7 +519,7 @@ _cupsRasterExecPS(
 
 
   DEBUG_printf(("_cupsRasterExecPS(h=%p, preferred_bits=%p, code=\"%s\")\n",
-                h, preferred_bits, code ? code : "(null)"));
+                h, preferred_bits, code));
 
  /*
   * Copy the PostScript code and create a stack...
@@ -639,12 +654,13 @@ _cupsRasterExecPS(
 
       case CUPS_PS_OTHER :
           _cupsRasterAddError("Unknown operator \"%s\"!\n", obj->value.other);
+         error = 1;
           DEBUG_printf(("_cupsRasterExecPS: Unknown operator \"%s\"!\n",
                        obj->value.other));
           break;
     }
 
-    if (obj && obj->type == CUPS_PS_OTHER)
+    if (error)
       break;
   }
 
@@ -931,7 +947,7 @@ push_stack(_cups_ps_stack_t *st,    /* I - Stack */
 
     st->alloc_objs += 32;
 
-    if ((temp = realloc(st->objs, st->alloc_objs *
+    if ((temp = realloc(st->objs, (size_t)st->alloc_objs *
                                   sizeof(_cups_ps_obj_t))) == NULL)
       return (NULL);
 
@@ -992,12 +1008,12 @@ roll_stack(_cups_ps_stack_t *st, /* I - Stack */
 
     s = -s;
 
-    if ((temp = calloc(s, sizeof(_cups_ps_obj_t))) == NULL)
+    if ((temp = calloc((size_t)s, sizeof(_cups_ps_obj_t))) == NULL)
       return (-1);
 
-    memcpy(temp, st->objs + n, s * sizeof(_cups_ps_obj_t));
-    memmove(st->objs + n, st->objs + n + s, (c - s) * sizeof(_cups_ps_obj_t));
-    memcpy(st->objs + n + c - s, temp, s * sizeof(_cups_ps_obj_t));
+    memcpy(temp, st->objs + n, (size_t)s * sizeof(_cups_ps_obj_t));
+    memmove(st->objs + n, st->objs + n + s, (size_t)(c - s) * sizeof(_cups_ps_obj_t));
+    memcpy(st->objs + n + c - s, temp, (size_t)s * sizeof(_cups_ps_obj_t));
   }
   else
   {
@@ -1005,13 +1021,12 @@ roll_stack(_cups_ps_stack_t *st,        /* I - Stack */
     * Shift up...
     */
 
-    if ((temp = calloc(s, sizeof(_cups_ps_obj_t))) == NULL)
+    if ((temp = calloc((size_t)s, sizeof(_cups_ps_obj_t))) == NULL)
       return (-1);
 
-    memcpy(temp, st->objs + n + c - s, s * sizeof(_cups_ps_obj_t));
-    memmove(st->objs + n + s, st->objs + n,
-            (c - s) * sizeof(_cups_ps_obj_t));
-    memcpy(st->objs + n, temp, s * sizeof(_cups_ps_obj_t));
+    memcpy(temp, st->objs + n + c - s, (size_t)s * sizeof(_cups_ps_obj_t));
+    memmove(st->objs + n + s, st->objs + n, (size_t)(c - s) * sizeof(_cups_ps_obj_t));
+    memcpy(st->objs + n, temp, (size_t)s * sizeof(_cups_ps_obj_t));
   }
 
   free(temp);
@@ -1130,7 +1145,7 @@ scan_ps(_cups_ps_stack_t *st,             /* I  - Stack */
                ch = (ch << 3) + *cur - '0';
              }
 
-             *valptr++ = ch;
+             *valptr++ = (char)ch;
            }
            else if (*cur == '\r')
            {
@@ -1207,7 +1222,7 @@ scan_ps(_cups_ps_stack_t *st,             /* I  - Stack */
                ch |= tolower(*cur) - 'a' + 10;
             }
 
-           *valptr++ = ch;
+           *valptr++ = (char)ch;
           }
 
           if (*cur != '>')