From a1a99aa6d24736cf6892c6872133b7c72e28221a Mon Sep 17 00:00:00 2001 From: aizu-m Date: Sat, 13 Jun 2026 21:31:10 +0530 Subject: [PATCH] size CompBuffer for dot-matrix expansion in rastertoepson OutputLine writes one byte per pixel column (cupsWidth) into CompBuffer while StartPage only sized it for cupsBytesPerLine, so a wide low-bpp page sent to a dot-matrix queue overran the heap allocation. --- filter/rastertoepson.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/filter/rastertoepson.c b/filter/rastertoepson.c index 5538e7b32..c235e0548 100644 --- a/filter/rastertoepson.c +++ b/filter/rastertoepson.c @@ -298,7 +298,19 @@ StartPage( if (header->cupsCompression || DotBytes) { - if ((CompBuffer = calloc(2, header->cupsBytesPerLine + 1)) == NULL) + size_t comp_size; /* Size of compression buffer */ + + /* + * CompBuffer holds the PackBits-compressed line (up to two bytes per + * cupsBytesPerLine byte), or one byte per pixel column (cupsWidth) when + * OutputLine expands a dot-matrix row, so size it for the larger of the two. + */ + + comp_size = 2 * ((size_t)header->cupsBytesPerLine + 1); + if ((size_t)header->cupsWidth >= comp_size) + comp_size = (size_t)header->cupsWidth + 1; + + if ((CompBuffer = calloc(1, comp_size)) == NULL) { fputs("ERROR: Unable to allocate memory\n", stderr); exit(1);