Skip to content

rastertoescpx: validate PPD row geometry before sizing #720

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
carrerasdarren-cell wants to merge 1 commit into
base: master
Choose a base branch
from
Open

rastertoescpx: validate PPD row geometry before sizing #720

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
85 changes: 64 additions & 21 deletions filter/rastertoescpx.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,8 @@
#include <cupsfilters/driver.h>
#include <ppd/ppd.h>
#include "escp.h"
#include <limits.h>
#include <stdint.h>
#include <signal.h>
#include <string.h>
#include <ctype.h>
Expand Down Expand Up @@ -144,6 +146,9 @@ StartPage(ppd_file_t *ppd, // I - PPD file
// Resolution string
spec[PPD_MAX_NAME]; // PPD attribute name
ppd_attr_t *attr; // Attribute from PPD file
int black_row_count, // PPD black-head row count
black_row_step; // PPD black-head row step
size_t comp_buffer_size; // Size of compression buffer
const float default_lut[2] = // Default dithering lookup table
{
0.0,
Expand Down Expand Up @@ -836,6 +841,43 @@ StartPage(ppd_file_t *ppd, // I - PPD file
DotColStep ++;
}

if (DotRowCount < 1 || DotRowStep < 1 || DotColStep < 1)
{
fputs("ERROR: Invalid ESC/P row geometry\n", stderr);
exit(1);
}

if ((DotRowCount > 1 || DotRowStep > 1) && PrinterPlanes == 1 &&
(attr = ppdFindAttr(ppd, "cupsESCPBlack", resolution)) != NULL &&
attr->value)
{
//
// Apply custom black head data before deriving buffer sizes and the
// softweave schedule.
//

if (sscanf(attr->value, "%d%d", &black_row_count, &black_row_step) != 2)
{
fprintf(stderr, "ERROR: Invalid cupsESCPBlack value \"%s\"\n",
attr->value);
exit(1);
}

DotRowCount = black_row_count;
DotRowStep = black_row_step;
}

if (DotRowCount < 1 || DotRowStep < 1 ||
DotRowCount > INT_MAX / DotRowStep ||
((DotRowCount > 1 || DotRowStep > 1) &&
((size_t)DotColStep > sizeof(DotBands) / sizeof(DotBands[0]) ||
(size_t)DotRowStep >
sizeof(DotBands) / sizeof(DotBands[0]) / (size_t)DotColStep)))
{
fputs("ERROR: Invalid ESC/P row geometry\n", stderr);
exit(1);
}

//
// Setup softweave parameters...
//
Expand Down Expand Up @@ -867,23 +909,7 @@ StartPage(ppd_file_t *ppd, // I - PPD file

memset(DotRowOffset, 0, sizeof(DotRowOffset));

if (PrinterPlanes == 1)
{
//
// Use full height of print head...
//

if ((attr = ppdFindAttr(ppd, "cupsESCPBlack", resolution)) != NULL &&
attr->value)
{
//
// Use custom black head data...
//

sscanf(attr->value, "%d%d", &DotRowCount, &DotRowStep);
}
}
else if (ppd->model_number & ESCP_STAGGER)
if (PrinterPlanes > 1 && (ppd->model_number & ESCP_STAGGER))
{
//
// Use staggered print head...
Expand Down Expand Up @@ -912,11 +938,16 @@ StartPage(ppd_file_t *ppd, // I - PPD file

for (i = 0; i < bands; i ++)
{
band = (cups_weave_t *)calloc(1, sizeof(cups_weave_t));
band = (cups_weave_t *)calloc(1, sizeof(cups_weave_t));
if (band == NULL ||
(band->buffer = calloc(DotRowCount, DotBufferSize)) == NULL)
{
fputs("ERROR: Unable to allocate band buffer\n", stderr);
exit(1);
}

band->next = DotAvailList;
DotAvailList = band;

band->buffer = calloc(DotRowCount, DotBufferSize);
}

if (!DotAvailList)
Expand Down Expand Up @@ -1050,7 +1081,19 @@ StartPage(ppd_file_t *ppd, // I - PPD file
if (RGB)
CMYKBuffer = malloc(header->cupsWidth * PrinterPlanes);

CompBuffer = malloc(10 * DotBufferSize * DotRowMax);
if (DotBufferSize <= 0 ||
(size_t)DotBufferSize > SIZE_MAX / 10 / (size_t)DotRowMax)
{
fputs("ERROR: Invalid ESC/P compression buffer size\n", stderr);
exit(1);
}

comp_buffer_size = 10 * (size_t)DotBufferSize * (size_t)DotRowMax;
if ((CompBuffer = malloc(comp_buffer_size)) == NULL)
{
fputs("ERROR: Unable to allocate compression buffer\n", stderr);
exit(1);
}
}


Expand Down