|
 |
ba7055 |
diff -up cups-filters-1.0.35/filter/textcommon.c.CVE-2015-3258-3279 cups-filters-1.0.35/filter/textcommon.c
|
|
|
ba7055 |
--- cups-filters-1.0.35/filter/textcommon.c.CVE-2015-3258-3279 2013-05-07 19:24:58.000000000 +0100
|
|
|
ba7055 |
+++ cups-filters-1.0.35/filter/textcommon.c 2015-07-09 08:16:32.506423028 +0100
|
|
|
ba7055 |
@@ -26,6 +26,7 @@
|
|
|
ba7055 |
*/
|
|
|
ba7055 |
|
|
|
ba7055 |
#include "textcommon.h"
|
|
|
ba7055 |
+#include <limits.h>
|
|
|
ba7055 |
|
|
|
ba7055 |
|
|
|
ba7055 |
/*
|
|
|
ba7055 |
@@ -644,6 +645,45 @@ TextMain(const char *name, /* I - Name o
|
|
|
ba7055 |
if (PrettyPrint)
|
|
|
ba7055 |
PageTop -= 216.0f / LinesPerInch;
|
|
|
ba7055 |
|
|
|
ba7055 |
+ /*
|
|
|
ba7055 |
+ * Allocate memory for the page...
|
|
|
ba7055 |
+ */
|
|
|
ba7055 |
+
|
|
|
ba7055 |
+ SizeColumns = (PageRight - PageLeft) / 72.0 * CharsPerInch;
|
|
|
ba7055 |
+ SizeLines = (PageTop - PageBottom) / 72.0 * LinesPerInch;
|
|
|
ba7055 |
+
|
|
|
ba7055 |
+ /*
|
|
|
ba7055 |
+ * Enforce minimum size...
|
|
|
ba7055 |
+ */
|
|
|
ba7055 |
+ if (SizeColumns < 1)
|
|
|
ba7055 |
+ SizeColumns = 1;
|
|
|
ba7055 |
+ if (SizeLines < 1)
|
|
|
ba7055 |
+ SizeLines = 1;
|
|
|
ba7055 |
+
|
|
|
ba7055 |
+ if (SizeLines >= INT_MAX / SizeColumns / sizeof(lchar_t))
|
|
|
ba7055 |
+ {
|
|
|
ba7055 |
+ fprintf(stderr, "ERROR: bad page size\n");
|
|
|
ba7055 |
+ exit(1);
|
|
|
ba7055 |
+ }
|
|
|
ba7055 |
+
|
|
|
ba7055 |
+ Page = calloc(sizeof(lchar_t *), SizeLines);
|
|
|
ba7055 |
+ if (!Page)
|
|
|
ba7055 |
+ {
|
|
|
ba7055 |
+ fprintf(stderr, "ERROR: cannot allocate memory for page\n");
|
|
|
ba7055 |
+ exit(1);
|
|
|
ba7055 |
+ }
|
|
|
ba7055 |
+
|
|
|
ba7055 |
+ Page[0] = calloc(sizeof(lchar_t), SizeColumns * SizeLines);
|
|
|
ba7055 |
+ if (!Page[0])
|
|
|
ba7055 |
+ {
|
|
|
ba7055 |
+ free(Page);
|
|
|
ba7055 |
+ fprintf(stderr, "ERROR: cannot allocate memory for page\n");
|
|
|
ba7055 |
+ exit(1);
|
|
|
ba7055 |
+ }
|
|
|
ba7055 |
+
|
|
|
ba7055 |
+ for (i = 1; i < SizeLines; i ++)
|
|
|
ba7055 |
+ Page[i] = Page[0] + i * SizeColumns;
|
|
|
ba7055 |
+
|
|
|
ba7055 |
Copies = atoi(argv[4]);
|
|
|
ba7055 |
|
|
|
ba7055 |
WriteProlog(argv[3], argv[2], getenv("CLASSIFICATION"),
|
|
|
ba7055 |
@@ -1122,6 +1162,8 @@ TextMain(const char *name, /* I - Name o
|
|
|
ba7055 |
if (ppd != NULL)
|
|
|
ba7055 |
ppdClose(ppd);
|
|
|
ba7055 |
|
|
|
ba7055 |
+ free(Page[0]);
|
|
|
ba7055 |
+ free(Page);
|
|
|
ba7055 |
return (0);
|
|
|
ba7055 |
}
|
|
|
ba7055 |
|
|
|
ba7055 |
diff -up cups-filters-1.0.35/filter/texttopdf.c.CVE-2015-3258-3279 cups-filters-1.0.35/filter/texttopdf.c
|
|
|
ba7055 |
--- cups-filters-1.0.35/filter/texttopdf.c.CVE-2015-3258-3279 2015-07-09 08:16:12.266663237 +0100
|
|
|
ba7055 |
+++ cups-filters-1.0.35/filter/texttopdf.c 2015-07-09 08:16:32.506423028 +0100
|
|
|
ba7055 |
@@ -172,9 +172,6 @@ WriteEpilogue(void)
|
|
|
ba7055 |
{ "FN","FB","FI" };
|
|
|
ba7055 |
int i,j;
|
|
|
ba7055 |
|
|
|
ba7055 |
- free(Page[0]);
|
|
|
ba7055 |
- free(Page);
|
|
|
ba7055 |
-
|
|
|
ba7055 |
// embed fonts
|
|
|
ba7055 |
for (i = PrettyPrint ? 2 : 1; i >= 0; i --) {
|
|
|
ba7055 |
for (j = 0; j < NumFonts; j ++)
|
|
|
ba7055 |
@@ -333,18 +330,6 @@ WriteProlog(const char *title, /* I - T
|
|
|
ba7055 |
PageTop -= 36;
|
|
|
ba7055 |
}
|
|
|
ba7055 |
|
|
|
ba7055 |
- /*
|
|
|
ba7055 |
- * Allocate memory for the page...
|
|
|
ba7055 |
- */
|
|
|
ba7055 |
-
|
|
|
ba7055 |
- SizeColumns = (PageRight - PageLeft) / 72.0 * CharsPerInch;
|
|
|
ba7055 |
- SizeLines = (PageTop - PageBottom) / 72.0 * LinesPerInch;
|
|
|
ba7055 |
-
|
|
|
ba7055 |
- Page = calloc(sizeof(lchar_t *), SizeLines);
|
|
|
ba7055 |
- Page[0] = calloc(sizeof(lchar_t), SizeColumns * SizeLines);
|
|
|
ba7055 |
- for (i = 1; i < SizeLines; i ++)
|
|
|
ba7055 |
- Page[i] = Page[0] + i * SizeColumns;
|
|
|
ba7055 |
-
|
|
|
ba7055 |
if (PageColumns > 1)
|
|
|
ba7055 |
{
|
|
|
ba7055 |
ColumnGutter = CharsPerInch / 2;
|