From 316c332fa0d8f3671574756d54b50d3d07805207 Mon Sep 17 00:00:00 2001 From: Michael Sweet Date: Tue, 17 Jan 2017 11:59:38 -0500 Subject: [PATCH] Fix rastertopwg line offset bug (Issue #4942) --- CHANGES.txt | 3 ++- filter/rastertopwg.c | 5 ++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/CHANGES.txt b/CHANGES.txt index b35b9af78..4be9f3fd1 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -1,4 +1,4 @@ -CHANGES.txt - 2.2.2 - 2017-01-16 +CHANGES.txt - 2.2.2 - 2017-01-17 -------------------------------- CHANGES IN CUPS V2.2.2 @@ -7,6 +7,7 @@ CHANGES IN CUPS V2.2.2 - Fixed some issues with IPP Everywhere printer support (Issue #4893, Issue #4909, Issue #4916, Issue #4921, Issue #4923, Issue #4932, Issue #4933, Issue #4938) + - The rastertopwg filter could crash with certain input (Issue #4942) - Optimized connection usage in the IPP backend () - The scheduler did not detect when an encrypted connection was closed diff --git a/filter/rastertopwg.c b/filter/rastertopwg.c index 5026f5654..5413df04c 100644 --- a/filter/rastertopwg.c +++ b/filter/rastertopwg.c @@ -1,7 +1,7 @@ /* * CUPS raster to PWG raster format filter for CUPS. * - * Copyright 2011, 2014-2016 Apple Inc. + * Copyright 2011, 2014-2017 Apple Inc. * * These coded instructions, statements, and computer programs are the * property of Apple Inc. and are protected by Federal copyright law. @@ -435,6 +435,9 @@ main(int argc, /* I - Number of command-line args */ if (linesize < inheader.cupsBytesPerLine) linesize = inheader.cupsBytesPerLine; + if ((lineoffset + inheader.cupsBytesPerLine) > linesize) + lineoffset = linesize - inheader.cupsBytesPerLine; + line = malloc(linesize); memset(line, white, linesize); -- 2.39.2