rastertopwg: heap buffer overflow

[michaelrsweet]

Version: 2.0-current
CUPS.org User: pdewacht

In the rastertopwg filter, a malformed raster file can cause the filter to allocate a line buffer that's smaller than cupsBytesPerLine. As a result, cupsRasterReadPixels will write beyond the end of this buffer. A sample file is attached.

This can be remotely triggered on a print server that shares a printer that uses the rastertopwg filter.

Found using afl-fuzz.

[michaelrsweet]

CUPS.org User: mike

Fixed in Subversion repository.

[michaelrsweet]

"str4598.patch":

Index: filter/rastertopwg.c

--- filter/rastertopwg.c (revision 12567)
+++ filter/rastertopwg.c (working copy)
@@ -3,7 +3,7 @@
*

• CUPS raster to PWG raster format filter for CUPS.
  *

  • * Copyright 2011, 2014 Apple Inc.
  • * Copyright 2011, 2014-2015 Apple Inc.
    *

• These coded instructions, statements, and computer programs are the

• property of Apple Inc. and are protected by Federal copyright law.
  @@ -401,6 +401,9 @@

  • Copy raster data...
    */

• if (linesize < inheader.cupsBytesPerLine)

•  linesize = inheader.cupsBytesPerLine;
  

  line = malloc(linesize);

  memset(line, white, linesize);