[tanjiroK-coder]

1. pcl_start_page and ps_start_page build the page margins by subtracting a fixed 1/4" (PCL) or 1/6" (PostScript) margin from cupsWidth/cupsHeight into unsigned fields. When the media is smaller than twice that margin the subtraction wraps around, so right and bottom become ~4 billion.
2. dither_gray/pack_* read right - left pixels per line and the band loop iterates bottom - top rows, so both then run far past the band buffer.

The media size is attacker-reachable: ippeveprinter and the rest of the IPP Everywhere path pass the job's media, including small custom and roll sizes, straight to this filter. On a sanitizer build it is a heap-buffer-overflow READ (adjacent heap bytes end up in the output raster):

$ tools/ipptransform -m application/vnd.hp-pcl -o media=custom_x_5x80mm -r 300dpi -t black_1 examples/document-letter.pdf >/dev/null
==ERROR: AddressSanitizer: heap-buffer-overflow ... in dither_gray ipptransform.c:1671
$ tools/ipptransform -m application/postscript -o media=custom_x_5x80mm -r 300dpi -t sgray_8 examples/document-letter.pdf >/dev/null
==ERROR: AddressSanitizer: heap-buffer-overflow ... in ps_write_line ipptransform.c:3047

Dropping a margin to zero when the page is too small to hold it keeps the computation in range; output for normal media is byte-identical. Added a tiny-media transform to run-tests.sh that aborts on the unpatched tree under the address sanitizer the CI already uses.

[michaelrsweet]

Will consider, needs cleanup for coding style. Also, no need for a long-term unit test for this and we prefer to write up the changelog entries...

[tanjiroK-coder]

Cleaned up the coding style and dropped the test, now just the margin fix in pcl_start_page/ps_start_page. Left the changelog out for you to write up.