Fix A4 crash in Epson 24-pin driver (Issue #5323)

diff --git a/CHANGES.md b/CHANGES.md
index 7adce63fae9e46680962d1f8cda9c077a20ddc34..b0278e1f4f7db60a2debf5226a8fee1c9c4334b5 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -7,6 +7,7 @@ Changes in CUPS v2.2.9
 
 - Fixed a regression in the changes to ippValidateAttribute (Issue #5322,
   Issue #5330)
+- Fixed a crash bug in the Epson dot matrix driver (Issue #5323)
 - The web interface did not list the IPP Everywhere "driver" (Issue #5338)
 - Fixed a memory leak for some IPP (extension) syntaxes.
 

diff --git a/filter/rastertoepson.c b/filter/rastertoepson.c
index 4efe6692b9cb6482b3625d60f7cc1e0d9c0ab159..3de491f92a0b6a79ad332094cc13023803ab2aa4 100644 (file)
--- a/filter/rastertoepson.c
+++ b/filter/rastertoepson.c
@@ -1,7 +1,7 @@
 /*
  * EPSON ESC/P and ESC/P2 filter for CUPS.
  *
- * Copyright 2007-2015 by Apple Inc.
+ * Copyright 2007-2018 by Apple Inc.
  * Copyright 1993-2007 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
@@ -307,7 +307,7 @@ StartPage(
 
   if (DotBytes)
   {
-    if ((LineBuffers[0] = calloc((size_t)DotBytes, header->cupsWidth * (size_t)(Shingling + 1))) == NULL)
+    if ((LineBuffers[0] = calloc((size_t)DotBytes, (header->cupsWidth + 7) * (size_t)(Shingling + 1))) == NULL)
     {
       fputs("ERROR: Unable to allocate memory\n", stderr);
       exit(1);