[tanjiroK-coder]

Out-of-bounds write in prepare_pages on documents with many pages

prepare_pages writes one p.outpages[] entry per output page but never checks the running index against the array's fixed size (XFORM_MAX_PAGES, 10000). The output page count never exceeds the input page count, which is summed from each document's pdfioFileGetNumPages, so a job whose document holds more than 10000 pages walks outpage past the end of the array and writes outpage->pdf and outpage->input[...] out of bounds. ipptransform is the IPP Everywhere transform run on client-submitted documents, through ippeveprinter and directly, so the page count is attacker-controlled.

The check lives in prepare_documents right after the per-document page totals are known, so an oversized job is refused before any layout happens. Jobs up to 10000 pages behave exactly as before.

I could not run make test in my environment (no OpenSSL or GnuTLS available), so I confirmed the write with an AddressSanitizer harness that mirrors the prepare_pages loop over an outpages[XFORM_MAX_PAGES] array (the harness heap-allocates the prepare struct): a 10001-page input reports an out-of-bounds WRITE one element past the array, exactly 10000 pages stays clean, and the new check prevents the overflow.

[michaelrsweet]

The number of input pages is not always the same as the number of output pages - "number-up" and "imposition-template" can map multiple input pages to a single output page, for example.