Fix buffer overflow in rastertopwg (STR #4598)

git-svn-id: svn+ssh://src.apple.com/svn/cups/cups.org/trunk@12568 a1ca3aef-8c08-0410-bb20-df032aa958be

diff --git a/CHANGES-2.0.txt b/CHANGES-2.0.txt
index 1bf59a935c43ce14c05b44b574ff5edf72ae1ebe..de1a5a7e432446b1f75adaa889990b822d36cc09 100644 (file)
--- a/CHANGES-2.0.txt
+++ b/CHANGES-2.0.txt
@@ -5,6 +5,7 @@ CHANGES IN CUPS V2.0.3
 
        - Restored missing generic printer icon file (STR #4587)
        - Fixed logging of configuration errors to show up as errors (STR #4582)
+       - Fixed buffer overflow in rastertopwg (STR #4598)
        - Added Russian translation (STR #4577)
 
 

diff --git a/filter/Makefile b/filter/Makefile
index 08451e9c4408bb1dd4124da4b48d800f663cb5b8..ab22a5ddd07743e88f5b58087096451e0c1d0452 100644 (file)
--- a/filter/Makefile
+++ b/filter/Makefile
@@ -367,6 +367,12 @@ rastertopwg:       rastertopwg.o ../cups/$(LIBCUPS) $(LIBCUPSIMAGE)
        echo Linking $@...
        $(CC) $(LDFLAGS) -o $@ rastertopwg.o $(LINKCUPSIMAGE) $(IMGLIBS) $(LIBS)
 
+rastertopwg-static:    rastertopwg.o ../cups/$(LIBCUPSSTATIC) libcupsimage.a
+       echo Linking $@...
+       $(CC) $(LDFLAGS) -o $@ rastertopwg.o libcupsimage.a \
+               ../cups/$(LIBCUPSSTATIC) $(IMGLIBS) $(DSOLIBS) $(COMMONLIBS) \
+               $(SSLLIBS) $(DNSSDLIBS) $(LIBGSSAPI)
+
 
 #
 # testraster

diff --git a/filter/rastertopwg.c b/filter/rastertopwg.c
index 0116fb17345020f505a7c1bf6e51ba9fca2e3f84..12f77d66ff36ff94b481e0e243040b0b37b755ad 100644 (file)
--- a/filter/rastertopwg.c
+++ b/filter/rastertopwg.c
@@ -3,7 +3,7 @@
  *
  * CUPS raster to PWG raster format filter for CUPS.
  *
- * Copyright 2011, 2014 Apple Inc.
+ * Copyright 2011, 2014-2015 Apple Inc.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright law.
@@ -401,6 +401,9 @@ main(int  argc,                             /* I - Number of command-line args */
     * Copy raster data...
     */
 
+    if (linesize < inheader.cupsBytesPerLine)
+      linesize = inheader.cupsBytesPerLine;
+
     line = malloc(linesize);
 
     memset(line, white, linesize);