From: msweet <msweet@a1ca3aef-8c08-0410-bb20-df032aa958be>
Date: Thu, 26 Mar 2015 16:36:18 +0000 (+0000)
Subject: Fix potential buffer overflow in rastertohp (STR #4601)
X-Git-Tag: v2.2b1~325
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=50752acba9df1a5f5ee750c4ea8cd1fd7ee664c2;p=thirdparty%2Fcups.git

Fix potential buffer overflow in rastertohp (STR #4601)


git-svn-id: svn+ssh://src.apple.com/svn/cups/cups.org/trunk@12574 a1ca3aef-8c08-0410-bb20-df032aa958be
---

diff --git a/CHANGES-2.0.txt b/CHANGES-2.0.txt
index 56b28b5f57..6f2fe0e388 100644
--- a/CHANGES-2.0.txt
+++ b/CHANGES-2.0.txt
@@ -6,7 +6,7 @@ CHANGES IN CUPS V2.0.3
 	- Restored missing generic printer icon file (STR #4587)
 	- Fixed logging of configuration errors to show up as errors (STR #4582)
 	- Fixed potential buffer overflows in raster code and filters
-	  (STR #4598, STR #4599, STR #4600)
+	  (STR #4598, STR #4599, STR #4600, STR #4601)
 	- Added Russian translation (STR #4577)
 
 
diff --git a/filter/rastertohp.c b/filter/rastertohp.c
index 42d43c8f51..c7cc181228 100644
--- a/filter/rastertohp.c
+++ b/filter/rastertohp.c
@@ -3,7 +3,7 @@
  *
  * Hewlett-Packard Page Control Language filter for CUPS.
  *
- * Copyright 2007-2014 by Apple Inc.
+ * Copyright 2007-2015 by Apple Inc.
  * Copyright 1993-2007 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
@@ -354,7 +354,7 @@ StartPage(ppd_file_t         *ppd,	/* I - PPD file */
   * Allocate memory for a line of graphics...
   */
 
-  if ((Planes[0] = malloc(header->cupsBytesPerLine)) == NULL)
+  if ((Planes[0] = malloc(header->cupsBytesPerLine + NumPlanes)) == NULL)
   {
     fputs("ERROR: Unable to allocate memory\n", stderr);
     exit(1);
@@ -369,7 +369,7 @@ StartPage(ppd_file_t         *ppd,	/* I - PPD file */
     BitBuffer = NULL;
 
   if (header->cupsCompression)
-    CompBuffer = malloc(header->cupsBytesPerLine * 2);
+    CompBuffer = malloc(header->cupsBytesPerLine * 2 + 2);
   else
     CompBuffer = NULL;
 }