From c8ce56e0545a5f7bd4e6b4198588eaec991f1a61 Mon Sep 17 00:00:00 2001 From: Tobias Klausmann Date: Fri, 17 Jul 2026 16:28:32 +0200 Subject: [PATCH] libptouch: fix stack buffer overflow in ptouch_sendraster The raster packet buffer was fixed at 64 bytes, but a full raster line is max_px/8 bytes plus up to 4 header bytes. For printers with a printhead wider than 480px this overflows the buffer and smashes the stack. No previously supported printer was wide enough to trigger it (the widest, PT-9200DX at 384px, needs 52 bytes), but a 560px printhead needs 74. Size the buffer to 128 bytes, which is the maximum a single packet can be since ptouch_send() caps transfers at 128 bytes. --- src/libptouch.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/libptouch.c b/src/libptouch.c index f5580b7..9b93cf6 100644 --- a/src/libptouch.c +++ b/src/libptouch.c @@ -472,7 +472,10 @@ size_t ptouch_get_max_width(ptouch_dev ptdev) int ptouch_sendraster(ptouch_dev ptdev, uint8_t *data, size_t len) { - uint8_t buf[64]; + /* Must hold a full raster line (max_px/8 bytes) plus up to 4 header + bytes. ptouch_send() caps a packet at 128 bytes, so this is the + largest a packet can ever be. */ + uint8_t buf[128]; int rc; if (!ptdev) {