From: msweet <msweet@a1ca3aef-8c08-0410-bb20-df032aa958be>
Date: Wed, 6 May 2015 20:28:22 +0000 (+0000)
Subject: The sample Epson driver could crash (STR #4616)
X-Git-Tag: v2.2b1~311
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=dc991142c4fcf3f32fcc4c90ec6d68bc8c69a010;p=thirdparty%2Fcups.git

The sample Epson driver could crash (STR #4616)



git-svn-id: svn+ssh://src.apple.com/svn/cups/cups.org/trunk@12617 a1ca3aef-8c08-0410-bb20-df032aa958be
---

diff --git a/CHANGES-2.0.txt b/CHANGES-2.0.txt
index 3fa315d885..0f58789f3f 100644
--- a/CHANGES-2.0.txt
+++ b/CHANGES-2.0.txt
@@ -18,6 +18,7 @@ CHANGES IN CUPS V2.0.3
 	- The cups-lpd mini-daemon did not check for request parameters
 	  (STR #4603)
 	- The scheduler could get caught in a busy loop (STR #4605)
+	- The sample Epson driver could crash (STR #4616)
 	- Added Russian translation (STR #4577)
 
 
diff --git a/filter/rastertoepson.c b/filter/rastertoepson.c
index 7edd2097f2..b503795aef 100644
--- a/filter/rastertoepson.c
+++ b/filter/rastertoepson.c
@@ -3,7 +3,7 @@
  *
  * EPSON ESC/P and ESC/P2 filter for CUPS.
  *
- * Copyright 2007-2014 by Apple Inc.
+ * Copyright 2007-2015 by Apple Inc.
  * Copyright 1993-2007 by Easy Software Products.
  *
  * These coded instructions, statements, and computer programs are the
@@ -655,13 +655,19 @@ OutputLine(
         }
 
         for (width = header->cupsWidth, tempptr = CompBuffer;
-             width > 0;
+             width > 1;
              width -= 2, tempptr += 2, oddptr += DotBytes * 2,
 	         evenptr += DotBytes * 2)
         {
           evenptr[0] = tempptr[0];
           oddptr[0]  = tempptr[1];
         }
+
+        if (width == 1)
+        {
+          evenptr[0] = tempptr[0];
+          oddptr[0]  = tempptr[1];
+        }
       }
       else
       {
@@ -873,6 +879,9 @@ OutputRows(
 	putchar(0);
       }
 
+      if (dot_count & 1)
+        putchar(*ptr);
+
      /*
       * Move the head back and print the odd bytes...
       */
@@ -901,6 +910,9 @@ OutputRows(
 	putchar(0);
         putchar(*ptr);
       }
+
+      if (dot_count & 1)
+        putchar(0);
     }
     else
       pwrite(dot_ptr, dot_count);