m/ptouch-print
1
0
Fork 0
mirror of https://git.familie-radermacher.ch/linux/ptouch-print.git synced 2026-08-01 12:17:26 +00:00
Code Issues Releases Activity

libptouch: fix stack buffer overflow in ptouch_sendraster

Browse Source 
The raster packet buffer was fixed at 64 bytes, but a full raster line is
max_px/8 bytes plus up to 4 header bytes. For printers with a printhead
wider than 480px this overflows the buffer and smashes the stack. No
previously supported printer was wide enough to trigger it (the widest,
PT-9200DX at 384px, needs 52 bytes), but a 560px printhead needs 74.

Size the buffer to 128 bytes, which is the maximum a single packet can be
since ptouch_send() caps transfers at 128 bytes.
This commit is contained in:
Tobias Klausmann
2026-07-18 07:52:44 +02:00
committed by Dominic Radermacher
parent 5cf946bf43
commit c8ce56e054
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libptouch.c
+4 -1
View File
@@ -472,7 +472,10 @@ size_t ptouch_get_max_width(ptouch_dev ptdev)
int ptouch_sendraster(ptouch_dev ptdev, uint8_t *data, size_t len)
{
uint8_t buf[64];
/* Must hold a full raster line (max_px/8 bytes) plus up to 4 header
bytes. ptouch_send() caps a packet at 128 bytes, so this is the
largest a packet can ever be. */
uint8_t buf[128];
int rc;
if (!ptdev) {