From 2431caddb7e6a87f04ac90b5c6366ad268b6ff31 Mon Sep 17 00:00:00 2001
From: Zdenek Dohnal <zdohnal@redhat.com>
Date: Wed, 20 Sep 2023 14:45:17 +0200
Subject: [PATCH] raster-interpret.c: Fix CVE-2023-4504
 
We didn't check for end of buffer if it looks there is an escaped
character - check for NULL terminator there and if found, return NULL
as return value and in `ptr`, because a lone backslash is not
a valid PostScript character.
 
Reference:https://github.com/OpenPrinting/cups/commit/2431caddb7e6a87f04ac90b5c6366ad268b6ff31
Conflict:Unmodified CHANGES.md
 
---
 filter/interpret.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)
 
diff --git a/filter/interpret.c b/filter/interpret.c
index 031b1d5..191e759 100644
--- a/filter/interpret.c
+++ b/filter/interpret.c
@@ -1117,7 +1117,19 @@ scan_ps(_cups_ps_stack_t *st,		/* I  - Stack */
 
 	    cur ++;
 
-            if (*cur == 'b')
+	   /*
+	    * Return NULL if we reached NULL terminator, a lone backslash
+	    * is not a valid character in PostScript.
+	    */
+
+	    if (!*cur)
+	    {
+	      *ptr = NULL;
+
+	      return (NULL);
+	    }
+
+	    if (*cur == 'b')
 	      *valptr++ = '\b';
 	    else if (*cur == 'f')
 	      *valptr++ = '\f';
-- 
2.27.0