Skip to content

pwgtoraster: reject overflowing raster buffers #210

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tillkamppeter merged 2 commits into from
Aug 21, 2026
Merged

pwgtoraster: reject overflowing raster buffers #210

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
03cb4b8
pwgtoraster: reject overflowing expanded rows
carrerasdarren-cell Aug 21, 2026
f321529
pwgtoraster: check remaining buffer products
carrerasdarren-cell Aug 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
92 changes: 76 additions & 16 deletions cupsfilters/pwgtoraster.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1308,6 +1308,8 @@ out_page(pwgtoraster_doc_t *doc,
unsigned char *dp;
unsigned int inlineoffset, // Offset where to start in input line (bytes)
inlinesize; // How many bytes to take from input line
size_t input_line_size,
inline_end;
int input_color_mode;
int color_mode_needed;
bool ret = true;
Expand Down Expand Up @@ -1753,24 +1755,80 @@ out_page(pwgtoraster_doc_t *doc,
// enough space.
//

i = doc->inheader.cupsBytesPerLine * res_up_factor[0];
j = inlineoffset + inlinesize;
if (j > i)
i = j;
line =
(unsigned char *)calloc(i, sizeof(unsigned char));
if (doc->inheader.cupsBytesPerLine >
UINT_MAX / res_up_factor[0])
{
if (log) log(ld, CF_LOGLEVEL_ERROR,
"cfFilterPWGToRaster: Input line is too large after horizontal resolution conversion.");
ret = false;
goto out;
}

input_line_size = (size_t)doc->inheader.cupsBytesPerLine *
res_up_factor[0];
if (inlineoffset > UINT_MAX - inlinesize)
{
if (log) log(ld, CF_LOGLEVEL_ERROR,
"cfFilterPWGToRaster: Input line offset and size are too large.");
ret = false;
goto out;
}
inline_end = (size_t)inlineoffset + inlinesize;
if (inline_end > input_line_size)
input_line_size = inline_end;

line = (unsigned char *)calloc(input_line_size, sizeof(unsigned char));
if (!line)
{
if (log) log(ld, CF_LOGLEVEL_ERROR,
"cfFilterPWGToRaster: Unable to allocate input line buffer.");
ret = false;
goto out;
}

// Input line averaging buffer (to reduce resolution)
if (res_down_factor[1] > 1 && input_color_mode > 0)
lineavg =
(unsigned char *)calloc(doc->inheader.cupsBytesPerLine *
res_down_factor[1],
sizeof(unsigned char));
{
if (doc->inheader.cupsBytesPerLine >
UINT_MAX / res_down_factor[1])
{
if (log) log(ld, CF_LOGLEVEL_ERROR,
"cfFilterPWGToRaster: Input line averaging buffer is too large.");
ret = false;
goto out;
}
lineavg = (unsigned char *)calloc(res_down_factor[1],
doc->inheader.cupsBytesPerLine);
if (!lineavg)
{
if (log) log(ld, CF_LOGLEVEL_ERROR,
"cfFilterPWGToRaster: Unable to allocate input line averaging buffer.");
ret = false;
goto out;
}
}

// Input page buffer for color ordered in planes (if needed)
if (doc->nplanes > 1)
pagebuf = (unsigned char *)calloc(doc->outheader.cupsHeight * inlinesize,
sizeof(unsigned char));
{
if (inlinesize &&
doc->outheader.cupsHeight > UINT_MAX / inlinesize)
{
if (log) log(ld, CF_LOGLEVEL_ERROR,
"cfFilterPWGToRaster: Planar input page buffer is too large.");
ret = false;
goto out;
}
pagebuf = (unsigned char *)calloc(doc->outheader.cupsHeight,
inlinesize);
if (!pagebuf)
{
if (log) log(ld, CF_LOGLEVEL_ERROR,
"cfFilterPWGToRaster: Unable to allocate planar input page buffer.");
ret = false;
goto out;
}
}

//
// Overspray stretch of the input image If the output page
Expand Down Expand Up @@ -1903,7 +1961,7 @@ out_page(pwgtoraster_doc_t *doc,

// Collect lines for averaging (when reducing vertical resolution)
if (res_down_factor[1] > 1 && input_color_mode > 0)
memcpy(lineavg + i * doc->inheader.cupsBytesPerLine,
memcpy(lineavg + (size_t)i * doc->inheader.cupsBytesPerLine,
line, doc->inheader.cupsBytesPerLine);
}

Expand All @@ -1915,7 +1973,8 @@ out_page(pwgtoraster_doc_t *doc,
{
int val = 0;
for (j = 0; j < res_down_factor[1]; j ++)
val += (int)*(lineavg + j * doc->inheader.cupsBytesPerLine +
val += (int)*(lineavg +
(size_t)j * doc->inheader.cupsBytesPerLine +
i);
line[i] = (unsigned char)(val / res_down_factor[1]);
}
Expand Down Expand Up @@ -2156,15 +2215,16 @@ out_page(pwgtoraster_doc_t *doc,

// Save input line for the other planes
if (doc->nplanes > 1)
memcpy(pagebuf + (y - doc->bitmapoffset[1]) * inlinesize,
memcpy(pagebuf +
(size_t)(y - doc->bitmapoffset[1]) * inlinesize,
bp, inlinesize);
}
else
{
// Further planes

// Pointer to input line in page buffer
bp = pagebuf + (y - doc->bitmapoffset[1]) * inlinesize;
bp = pagebuf + (size_t)(y - doc->bitmapoffset[1]) * inlinesize;
}

// Pre-convert into the color mode needed to convert to the final
Expand Down
Loading