Fix rastertopwg line offset bug (Issue #4942)

diff --git a/CHANGES.txt b/CHANGES.txt
index b35b9af78f4f637989abddecb83e5bcad94cb656..4be9f3fd13610536542c122540b527e0d6db8061 100644 (file)
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,4 +1,4 @@
-CHANGES.txt - 2.2.2 - 2017-01-16
+CHANGES.txt - 2.2.2 - 2017-01-17
 --------------------------------
 
 CHANGES IN CUPS V2.2.2
@@ -7,6 +7,7 @@ CHANGES IN CUPS V2.2.2
        - Fixed some issues with IPP Everywhere printer support (Issue #4893,
          Issue #4909, Issue #4916, Issue #4921, Issue #4923, Issue #4932,
          Issue #4933, Issue #4938)
+       - The rastertopwg filter could crash with certain input (Issue #4942)
        - Optimized connection usage in the IPP backend
          (<rdar://problem/29547323>)
        - The scheduler did not detect when an encrypted connection was closed

diff --git a/filter/rastertopwg.c b/filter/rastertopwg.c
index 5026f565432f8aab306168c5e639fb2cb1d546ce..5413df04c82d848989e3165163d302563ca35167 100644 (file)
--- a/filter/rastertopwg.c
+++ b/filter/rastertopwg.c
@@ -1,7 +1,7 @@
 /*
  * CUPS raster to PWG raster format filter for CUPS.
  *
- * Copyright 2011, 2014-2016 Apple Inc.
+ * Copyright 2011, 2014-2017 Apple Inc.
  *
  * These coded instructions, statements, and computer programs are the
  * property of Apple Inc. and are protected by Federal copyright law.
@@ -435,6 +435,9 @@ main(int  argc,                             /* I - Number of command-line args */
     if (linesize < inheader.cupsBytesPerLine)
       linesize = inheader.cupsBytesPerLine;
 
+    if ((lineoffset + inheader.cupsBytesPerLine) > linesize)
+      lineoffset = linesize - inheader.cupsBytesPerLine;
+
     line = malloc(linesize);
 
     memset(line, white, linesize);