Skip to content

fix integer overflow in pwg_scan_measurement - #176

Closed
tanjiroK-coder wants to merge 1 commit into
OpenPrinting:masterfrom
tanjiroK-coder:pwg-measurement-overflow
Closed

tanjiroK-coder wants to merge 1 commit into
OpenPrinting:masterfrom
tanjiroK-coder:pwg-measurement-overflow

Conversation

@tanjiroK-coder

Copy link
Copy Markdown
Contributor
  1. the digit loop in pwg_scan_measurement accumulates into an int, so a name with ten or more digits wraps: pwgMediaForPWG("custom_max_9999999999x9999999999mm") gives width and length of -727380068.
  2. value * numer overflows on its own for much shorter names since numer is up to 100000 for metres: custom_max_1000000x1000000in gives -1754967296.

Both accumulators are long long now and the return saturates at INT_MAX, so valid names decode exactly as before. The size name is remote input, it comes in on media-supported/media-ready and reaches here via cupsCheckDestSupported and cupsGetDestMediaByName, where a negative width then defeats the custom-size range check. Turned up running -fsanitize=undefined over the media name parsers, which fires at pwg-media.c:1065 and :1086; the two testpwg cases fail on master and pass with the change.

Assisted-by: Claude Code:claude-opus-5

The digit loop accumulates into an int and the final conversion multiplies by up to 100000, so an over-large media size name decodes to a negative width and length instead of a clamped value.

@michaelrsweet michaelrsweet left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

long long isn't universally supported.

Since the maximum value used in IPP is 2^31-1 hundredths of millimeters, I think we can safely just cap the integer portion of the measurement at 10000000 (10km or 157.8mi) and error out for larger values.

@michaelrsweet michaelrsweet self-assigned this Oct 12, 2026
@michaelrsweet michaelrsweet added bug Something isn't working priority-low labels Oct 12, 2026
@michaelrsweet michaelrsweet added this to the Stable milestone Oct 12, 2026
michaelrsweet added a commit that referenced this pull request Oct 12, 2026
@michaelrsweet

Copy link
Copy Markdown
Member

I ended up using 100000 as the maximum value since 2540 * 1000000 is just past the 2^31-1 limit:

[master 6849754] Add limits to PWG media dimension scaning (Issue #176)

[master a922dc0] Drop limit to 100000 (Issue #176)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working priority-low

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants