Fix heap corruption via callback signature mismatch in cfFilterPCLmToRaster

[akoul]

Summary

process_image() in cupsfilters/pclmtoraster.c was declared with 5 parameters but cast to pdfio_dict_cb_t (a 3-parameter callback type) at line 1035. When invoked by pdfioDictIterateKeys(), the 4th and 5th parameters (pixel_count, bitmap) received undefined CPU register values. The function then called realloc() on the garbage bitmap pointer and memcpy() to write image data to the resulting address — guaranteed heap corruption/crash on any PCLm input with XObject images.

Root Cause

// BEFORE (dangerous cast, 5-param function called with 3 args):
pdfioDictIterateKeys(xobjects, (pdfio_dict_cb_t)process_image, data);

Fix

• Move pixel_count and bitmap into pclmtoraster_data_t struct (they were local variables in out_page() that could never reach process_image() through the callback interface anyway)
• Change process_image() signature to match pdfio_dict_cb_t (3 parameters: dict, key, void *cb_data)
• Remove the dangerous (pdfio_dict_cb_t) cast entirely
• Initialize new struct fields in init_pclmtoraster_data_t() and at the call site

// AFTER (correct signature, no cast):
data->pixel_count = 0;
data->bitmap = NULL;
pdfioDictIterateKeys(xobjects, process_image, data);

Impact

Without this fix, any PCLm file processed through cfFilterPCLmToRaster that contains XObject images causes heap corruption via realloc(garbage_pointer, ...) and memcpy(garbage_address, ...). Reachable via network printing (IPP/LPD).

Related

• GHSA-4v2x-px93-xmx4 (security advisory for this issue)
• Affects master branch only (post-commit 74fc5c3, not in stable 2.1.1)