Skip to content

fix out-of-bounds read in rastertolabel delta-row compare#1644

Open
aizu-m wants to merge 1 commit into
OpenPrinting:masterfrom
aizu-m:rastertolabel-pcl-compare-bounds
Open

fix out-of-bounds read in rastertolabel delta-row compare#1644
aizu-m wants to merge 1 commit into
OpenPrinting:masterfrom
aizu-m:rastertolabel-pcl-compare-bounds

Conversation

@aizu-m

@aizu-m aizu-m commented Jul 5, 2026

Copy link
Copy Markdown
Contributor

Building rastertolabel under ASan and pushing two identical non-blank raster lines to an INTELLITECH_PCL queue:

ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 1 at ... thread T0
    #0 PCLCompress rastertolabel.c:956
0 bytes after 16-byte region allocated by malloc (cupsBytesPerLine)

PCLCompress delta-row compresses each line against the previous one in LastBuffer. Buffer and LastBuffer are both malloc(cupsBytesPerLine). The two compare loops read *line_ptr/*seed first and test line_ptr < line_end second, so a run that reaches the end of the line re-reads one byte past both allocations before the loop exits. It fires whenever consecutive lines share a trailing run, not only on wholly identical lines, so most multi-line pages hit it.

Reordered both conditions to bound-check before the dereference. Valid input compresses to the same bytes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant