From 906b131140b409ddeccab527a02ec13438a2d754 Mon Sep 17 00:00:00 2001 From: Luke <2634536425@qq.com> Date: Tue, 5 Dec 2023 19:27:20 +0800 Subject: [PATCH] =?UTF-8?q?CVE-2020-27792=20Artifex=20Software=20Ghostscri?= =?UTF-8?q?pt=20=E5=AD=98=E5=9C=A8=E7=BC=93=E5=86=B2=E5=8C=BA=E9=94=99?= =?UTF-8?q?=E8=AF=AF=E6=BC=8F=E6=B4=9E?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- devices/gdevlp8k.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/devices/gdevlp8k.c b/devices/gdevlp8k.c index 0a9bc03..55af94d 100644 --- a/devices/gdevlp8k.c +++ b/devices/gdevlp8k.c @@ -185,7 +185,10 @@ lp8000_print_page(gx_device_printer *pdev, gp_file *prn_stream) unsigned int report_size; byte *buf1 = (byte *)gs_malloc(pdev->memory, in_size, 1, "lp8000_print_page(buf1)"); - byte *buf2 = (byte *)gs_malloc(pdev->memory, in_size, 1, "lp8000_print_page(buf2)"); + + /* Worst case for rle compression below is 3 bytes for each 2 bytes of + input, with extra final byte. */ + byte *buf2 = (byte *)gs_malloc(pdev->memory, in_size * 3 / 2 + 2, 1, "lp8000_print_page(buf2)"); byte *in = buf1; byte *out = buf2; -- Gitee