]> git.ipfire.org Git - thirdparty/cups.git/commitdiff
Fix UB in cups_raster_read debug message 607/head
authorBenjamin Gordon <bmgordon@chromium.org>
Wed, 1 Feb 2023 17:01:42 +0000 (10:01 -0700)
committerBenjamin Gordon <bmgordon@chromium.org>
Wed, 1 Feb 2023 17:01:42 +0000 (10:01 -0700)
The first time `cups_raster_read` is called, both `r->bufptr` and
`r->buffer` are NULL.  The calculation here then ends up looking like
adding a size_t to a NULL pointer, which triggers the ubsan detector.
Since we just want an offset, cast the pointer difference to ssize_t
like the code already does a few lines below.

cups/raster-stream.c

index c51869e4fc98fe429e9cee162157d0da28405f17..aea71b0338014fa3cdbc73565558f096647cf458 100644 (file)
@@ -1409,7 +1409,7 @@ cups_raster_read(cups_raster_t *r,        /* I - Raster stream */
                total;                  /* Total bytes read */
 
 
-  DEBUG_printf(("4cups_raster_read(r=%p, buf=%p, bytes=" CUPS_LLFMT "), offset=" CUPS_LLFMT, (void *)r, (void *)buf, CUPS_LLCAST bytes, CUPS_LLCAST (r->iostart + r->bufptr - r->buffer)));
+  DEBUG_printf(("4cups_raster_read(r=%p, buf=%p, bytes=" CUPS_LLFMT "), offset=" CUPS_LLFMT, (void *)r, (void *)buf, CUPS_LLCAST bytes, CUPS_LLCAST (r->iostart + (ssize_t)(r->bufptr - r->buffer))));
 
   if (!r->compressed)
     return (cups_raster_io(r, buf, bytes));