From 4eb654503e55f7be39f1441df340f5e7219dc04c Mon Sep 17 00:00:00 2001 From: Michael R Sweet Date: Mon, 25 Mar 2024 15:07:53 -0400 Subject: [PATCH] Update changelog and make sure we have the len==0 check for cupsRasterReadPixels as well. --- CHANGES.md | 2 ++ cups/raster-stream.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGES.md b/CHANGES.md index 59c508ce87..1ae376fd49 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -23,6 +23,8 @@ Changes in CUPS v2.5b1 (TBA) (Issue #751) - Updated `httpAddrConnect2()` to handle `POLLHUP` together with `POLLIN` or `POLLOUT` (Issue #839) +- Updated `cupsRasterReadPixels` and `cupsRasterWritePixels` to not try reading + or writing if the number of bytes passed is 0 (Issue #914) - Fixed use-after-free in `cupsdAcceptClient()` when we log warning during error handling (fixes CVE-2023-34241) - Fixed hanging of `lpstat` on Solaris (Issue #156) diff --git a/cups/raster-stream.c b/cups/raster-stream.c index f130670097..643943aa57 100644 --- a/cups/raster-stream.c +++ b/cups/raster-stream.c @@ -1038,7 +1038,7 @@ _cupsRasterReadPixels( DEBUG_printf("_cupsRasterReadPixels(r=%p, p=%p, len=%u)", (void *)r, (void *)p, len); if (r == NULL || r->mode != CUPS_RASTER_READ || r->remaining == 0 || - r->header.cupsBytesPerLine == 0) + r->header.cupsBytesPerLine == 0 || len == 0) { DEBUG_puts("1_cupsRasterReadPixels: Returning 0."); return (0); -- 2.47.2