Update changelog and make sure we have the len==0 check for cupsRasterReadPixels...

diff --git a/CHANGES.md b/CHANGES.md
index 59c508ce87dc2ec77d5e486a7fc688ec4c406896..1ae376fd494947ec99f24ca07c5229282e7c1389 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -23,6 +23,8 @@ Changes in CUPS v2.5b1 (TBA)
   (Issue #751)
 - Updated `httpAddrConnect2()` to handle `POLLHUP` together with `POLLIN` or
   `POLLOUT` (Issue #839)
+- Updated `cupsRasterReadPixels` and `cupsRasterWritePixels` to not try reading
+  or writing if the number of bytes passed is 0 (Issue #914)
 - Fixed use-after-free in `cupsdAcceptClient()` when we log warning during error
   handling (fixes CVE-2023-34241)
 - Fixed hanging of `lpstat` on Solaris (Issue #156)

diff --git a/cups/raster-stream.c b/cups/raster-stream.c
index f130670097b7a6df8591071eadaf1b0617713c8a..643943aa57bff62de595cd1626e07951c09897d8 100644 (file)
--- a/cups/raster-stream.c
+++ b/cups/raster-stream.c
@@ -1038,7 +1038,7 @@ _cupsRasterReadPixels(
   DEBUG_printf("_cupsRasterReadPixels(r=%p, p=%p, len=%u)", (void *)r, (void *)p, len);
 
   if (r == NULL || r->mode != CUPS_RASTER_READ || r->remaining == 0 ||
-      r->header.cupsBytesPerLine == 0)
+      r->header.cupsBytesPerLine == 0 || len == 0)
   {
     DEBUG_puts("1_cupsRasterReadPixels: Returning 0.");
     return (0);