Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Missing malloc checks in texttops #3516

Closed
michaelrsweet opened this issue Mar 2, 2010 · 2 comments
Closed

Missing malloc checks in texttops #3516

michaelrsweet opened this issue Mar 2, 2010 · 2 comments
Labels
Milestone

Comments

@michaelrsweet
Copy link
Collaborator

@michaelrsweet michaelrsweet commented Mar 2, 2010

Version: 1.4-current
CUPS.org User: mike

The texttops filter doesn't check the results of the page array allocations which could lead to a heap attack.

@michaelrsweet

This comment has been minimized.

Copy link
Collaborator Author

@michaelrsweet michaelrsweet commented Jun 16, 2010

CUPS.org User: mike

Fixed in Subversion repository.

@michaelrsweet

This comment has been minimized.

Copy link
Collaborator Author

@michaelrsweet michaelrsweet commented Jul 7, 2010

"str3516.patch":

Index: filter/texttops.c

--- filter/texttops.c (revision 9008)
+++ filter/texttops.c (working copy)
@@ -3,7 +3,7 @@
*

  • Text to PostScript filter for the Common UNIX Printing System (CUPS).
  • * Copyright 2007-2008 by Apple Inc.
  • * Copyright 2007-2010 by Apple Inc.
  • Copyright 1993-2007 by Easy Software Products.
  • These coded instructions, statements, and computer programs are the
    @@ -176,13 +176,25 @@
    if (SizeColumns <= 0 || SizeColumns > 32767 ||
    SizeLines <= 0 || SizeLines > 32767)
    {
  • _cupsLangPrintf(stderr, _("ERROR: Unable to print %dx%d text page\n"),
  • _cupsLangPrintf(stderr, _("ERROR: Unable to print %dx%d text page.\n"),
    SizeColumns, SizeLines);
    exit(1);
    }
  • Page = calloc(sizeof(lchar_t *), SizeLines);
  • Page[0] = calloc(sizeof(lchar_t), SizeColumns * SizeLines);
  • if ((Page = calloc(sizeof(lchar_t *), SizeLines)) == NULL)
  • {
  • _cupsLangPrintf(stderr, _("ERROR: Unable to print %dx%d text page.\n"),
  •                SizeColumns, SizeLines);
    
  • exit(1);
  • }
  • if ((Page[0] = calloc(sizeof(lchar_t), SizeColumns * SizeLines)) == NULL)
  • {
  • _cupsLangPrintf(stderr, _("ERROR: Unable to print %dx%d text page.\n"),
  •                SizeColumns, SizeLines);
    
  • exit(1);
  • }

for (i = 1; i < SizeLines; i ++)
Page[i] = Page[0] + i * SizeColumns;

@michaelrsweet michaelrsweet added this to the Stable milestone Mar 17, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
1 participant
You can’t perform that action at this time.