Skip to content

fix out-of-bounds read in rastertolabel delta-row compare#1644

Open
aizu-m wants to merge 1 commit into
OpenPrinting:masterfrom
aizu-m:rastertolabel-pcl-compare-bounds
Open

fix out-of-bounds read in rastertolabel delta-row compare#1644
aizu-m wants to merge 1 commit into
OpenPrinting:masterfrom
aizu-m:rastertolabel-pcl-compare-bounds

Conversation

@aizu-m

@aizu-m aizu-m commented Jul 5, 2026

Copy link
Copy Markdown
Contributor

Building rastertolabel under ASan and pushing two identical non-blank raster lines to an INTELLITECH_PCL queue:

ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 1 at ... thread T0
    #0 PCLCompress rastertolabel.c:956
0 bytes after 16-byte region allocated by malloc (cupsBytesPerLine)

PCLCompress delta-row compresses each line against the previous one in LastBuffer. Buffer and LastBuffer are both malloc(cupsBytesPerLine). The two compare loops read *line_ptr/*seed first and test line_ptr < line_end second, so a run that reaches the end of the line re-reads one byte past both allocations before the loop exits. It fires whenever consecutive lines share a trailing run, not only on wholly identical lines, so most multi-line pages hit it.

Reordered both conditions to bound-check before the dereference. Valid input compresses to the same bytes.

@michaelrsweet michaelrsweet self-assigned this Jul 16, 2026
@michaelrsweet michaelrsweet added the investigating Investigating the issue label Jul 16, 2026
@michaelrsweet

Copy link
Copy Markdown
Member

Can you sign your commits please? Thanks!

Signed-off-by: Aizal Khan <aizumusheer2@gmail.com>
@aizu-m
aizu-m force-pushed the rastertolabel-pcl-compare-bounds branch from 93d07d0 to f142527 Compare July 17, 2026 10:11
@aizu-m

aizu-m commented Jul 17, 2026

Copy link
Copy Markdown
Contributor Author

Done. Amended the commit with a sign-off and force-pushed, diff itself is unchanged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

investigating Investigating the issue

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants