From: Pranav Batra <batrapranav@chromium.org>

Abort the print job if cupsBytesPerLine is greater than the size of the input
buffer or cupsWidth for the first page is smaller than cupsWidth of a
subsequent page. Also zero-initialize m_pPrinterBuffer.

Corresponding change in ChromeOS: https://crrev.com/c/3529326

--- a/prnt/hpcups/HPCupsFilter.cpp
+++ b/prnt/hpcups/HPCupsFilter.cpp
@@ -510,8 +510,6 @@ DRIVER_ERROR HPCupsFilter::startPage (cups_page_header2_t *cups_header)
         dbglog("HPCUPS: returning NO_ERROR from startPage\n");
     }
 
-    m_pPrinterBuffer = new BYTE[cups_header->cupsWidth * 4 + 32];
-
     return NO_ERROR;
 }
 
@@ -673,8 +671,31 @@ int HPCupsFilter::processRasterData(cups_raster_t *cups_raster)
 		imageProcessor = imageProcessorCreate();
 	    }
     #endif
+
+    unsigned buffer_size = 0;
+    unsigned cups_width = 0;
     while (cupsRasterReadHeader2(cups_raster, &cups_header))
     {
+        if (buffer_size == 0) {
+            buffer_size = cups_header.cupsWidth * 4 + 32;
+            cups_width = cups_header.cupsWidth;
+        }
+
+        // cupsBytesPerLine cannot be larger than the buffer size.
+        if (cups_header.cupsBytesPerLine > buffer_size) {
+            dbglog("ERROR: cupsBytesPerLine (%d) is larger than buffer size (%d)\n",
+                   cups_header.cupsBytesPerLine, buffer_size);
+            return SYSTEM_ERROR;
+        }
+
+        // cupsWidth cannot increase in size since the buffer allocated
+        // for the first page is reused for subsequent pages.
+        if (cups_header.cupsWidth  > cups_width) {
+            dbglog("ERROR: cupsWidth %d for page %d is larger than %d\n",
+                   cups_header.cupsWidth, current_page_number + 1, cups_width);
+            return SYSTEM_ERROR;
+        }
+
        #ifndef DISABLE_IMAGEPROCESSOR 
 		   if(strncmp(m_JA.printer_platform, "ljzjstream",10) == 0){
 		    result = imageProcessorStartPage(imageProcessor, &cups_header);
@@ -691,6 +712,12 @@ int HPCupsFilter::processRasterData(cups_raster_t *cups_raster)
                 return JOB_CANCELED;
             }
 
+            if (m_pPrinterBuffer) {
+                abort();
+            }
+
+            m_pPrinterBuffer = new BYTE[buffer_size]();
+
             if (m_JA.pre_process_raster) {
 		    	// CC ToDo: Why pSwapedPagesFileName should be sent as a parameter? 
                   	// Remove if not required to send it as parameter