From 4d792c28cc2125b9c6b2b532fa781d4a961bee55 Mon Sep 17 00:00:00 2001 From: Luuk Vinke Date: Mon, 2 Nov 2026 13:41:59 +0100 Subject: [PATCH] ppd-ipp.c: Check buffer length before "texttotext" suffix compare ppdLoadAttributes() compared buf + strlen(buf) - 10 against "texttotext" without checking the buffer length first, so a *cupsFilter value shorter than 10 characters read before the start of buf[]. Fixes #82 --- ppd/ppd-ipp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ppd/ppd-ipp.c b/ppd/ppd-ipp.c index 622ca52a..c21d36c5 100644 --- a/ppd/ppd-ipp.c +++ b/ppd/ppd-ipp.c @@ -525,7 +525,8 @@ ppdLoadAttributes( continue; // Is the PPD file using the "texttotext" filter? - if (strcmp(buf + strlen(buf) - 10, "texttotext") == 0) + if (strlen(buf) >= 10 && + strcmp(buf + strlen(buf) - 10, "texttotext") == 0) is_texttotext = 1; // Separate the first word