third_party_cups/ohos-fix-integer-overflow.patch

diff --git a/cups/raster-stream.c b/cups/raster-stream.c
index 307139fa..16fda4c9 100644
--- a/cups/raster-stream.c
+++ b/cups/raster-stream.c
@@ -688,11 +688,24 @@ _cupsRasterReadHeader(
           r->header.cupsBitsPerColor = r->header.cupsBitsPerPixel / r->header.cupsNumColors;
           r->header.cupsWidth        = ((unsigned)appleheader[12] << 24) | ((unsigned)appleheader[13] << 16) | ((unsigned)appleheader[14] << 8) | (unsigned)appleheader[15];
           r->header.cupsHeight       = ((unsigned)appleheader[16] << 24) | ((unsigned)appleheader[17] << 16) | ((unsigned)appleheader[18] << 8) | (unsigned)appleheader[19];
-          r->header.cupsBytesPerLine = r->header.cupsWidth * r->header.cupsBitsPerPixel / 8;
+          {
+            unsigned long long bits_per_line = (unsigned long long)r->header.cupsWidth * r->header.cupsBitsPerPixel;
+            if (bits_per_line > 0xffffffffU)
+            {
+              DEBUG_printf(("Raster dimensions too large (cupsWidth=%u, cupsBitsPerPixel=%u).", r->header.cupsWidth, r->header.cupsBitsPerPixel));
+              return (0);
+            }
+            r->header.cupsBytesPerLine = (unsigned)(bits_per_line / 8);
+          }
           r->header.cupsColorOrder   = CUPS_ORDER_CHUNKED;
           r->header.HWResolution[0]  = r->header.HWResolution[1] = ((unsigned)appleheader[20] << 24) | ((unsigned)appleheader[21] << 16) | ((unsigned)appleheader[22] << 8) | (unsigned)appleheader[23];
           if (r->header.HWResolution[0] > 0)
           {
+              if (r->header.cupsWidth > 0x00ffffff || r->header.cupsHeight > 0x00ffffff)
+              {
+                DEBUG_puts("Raster dimensions too large.");
+                return (0);
+              }
 	    r->header.PageSize[0]     = (r->header.cupsWidth * 72 / r->header.HWResolution[0]);
 	    r->header.PageSize[1]     = (r->header.cupsHeight * 72 / r->header.HWResolution[1]);
 	    r->header.cupsPageSize[0] = (float)(r->header.cupsWidth * 72.0 / r->header.HWResolution[0]);