Merge commit from fork

zdohnal · web-flow · commit 956283c74a34 · 2025-11-20T16:00:02.000+01:00
rastertopclx.c: Fix infinite loop caused by crafted file
diff --git a/filter/rastertopclx.c b/filter/rastertopclx.c
@@ -825,10 +825,10 @@ StartPage(cf_filter_data_t      *data,	// I - filter data
   }
 
   if (header->cupsCompression)
-    CompBuffer = malloc(DotBufferSize * 4);
+    CompBuffer = calloc(DotBufferSize * 4, sizeof(unsigned char));
 
   if (header->cupsCompression >= 3)
-    SeedBuffer = malloc(DotBufferSize);
+    SeedBuffer = calloc(DotBufferSize, sizeof(unsigned char));
 
   SeedInvalid = 1;
 
@@ -1159,6 +1159,13 @@ CompressData(unsigned char *line,	// I - Data to compress
               seed ++;
               count ++;
             }
+
+	    //
+	    // Bail out if we don't have count to compress
+	    //
+
+	    if (count == 0)
+	      break;
 	  }
 
 	  //
@@ -1252,6 +1259,13 @@ CompressData(unsigned char *line,	// I - Data to compress
 
             count = line_ptr - start;
 
+	    //
+	    // Bail out if we don't have count to compress
+	    //
+
+	    if (count == 0)
+	      break;
+
 #if 0
             fprintf(stderr,
 		    "DEBUG: offset=%d, count=%d, comp_ptr=%p(%d of %d)...\n",
@@ -1424,6 +1438,13 @@ CompressData(unsigned char *line,	// I - Data to compress
 
             count = (line_ptr - start) / 3;
 
+	    //
+	    // Bail out if we don't have count to compress
+	    //
+
+	    if (count == 0)
+	      break;
+
 	    //
 	    // Place mode 10 compression data in the buffer; each sequence
 	    // starts with a command byte that looks like:
