From b03866fd2e251a6d822a5e8c807c8d47b4d2dce2 Mon Sep 17 00:00:00 2001 From: Zdenek Dohnal Date: Wed, 12 Nov 2025 16:02:20 +0100 Subject: [PATCH] rastertopclx.c: Fix infinite loop caused by crafted file Infinite loop happened because of crafted input raster file, which led into heap buffer overflow of `CompressBuf` array. Based on comments there should be always some `count` when compressing the data, and processing of crafted file ended with offset and count being 0. Fixes CVE-2025-64524 Upstream: https://github.com/OpenPrinting/cups-filters/commit/b03866fd2e251a6d822a5e8c807c8d47b4d2dce2 CVE: CVE-2025-64524 Signed-off-by: Bernd Kuhls --- filter/rastertopclx.c | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/filter/rastertopclx.c b/filter/rastertopclx.c index 3e7c129da..1015308da 100644 --- a/filter/rastertopclx.c +++ b/filter/rastertopclx.c @@ -818,10 +818,10 @@ StartPage(ppd_file_t *ppd, /* I - PPD file */ } if (header->cupsCompression) - CompBuffer = malloc(DotBufferSize * 4); + CompBuffer = calloc(DotBufferSize * 4, sizeof(unsigned char)); if (header->cupsCompression >= 3) - SeedBuffer = malloc(DotBufferSize); + SeedBuffer = calloc(DotBufferSize, sizeof(unsigned char)); SeedInvalid = 1; @@ -1152,6 +1152,13 @@ CompressData(unsigned char *line, /* I - Data to compress */ seed ++; count ++; } + + // + // Bail out if we don't have count to compress + // + + if (count == 0) + break; } /* @@ -1245,6 +1252,13 @@ CompressData(unsigned char *line, /* I - Data to compress */ count = line_ptr - start; + // + // Bail out if we don't have count to compress + // + + if (count == 0) + break; + #if 0 fprintf(stderr, "DEBUG: offset=%d, count=%d, comp_ptr=%p(%d of %d)...\n", offset, count, comp_ptr, comp_ptr - CompBuffer, @@ -1416,6 +1430,13 @@ CompressData(unsigned char *line, /* I - Data to compress */ count = (line_ptr - start) / 3; + // + // Bail out if we don't have count to compress + // + + if (count == 0) + break; + /* * Place mode 10 compression data in the buffer; each sequence * starts with a command byte that looks like: -- 2.47.3