--- cups-1.1.17/filter/hpgl-input.c.str1024	2002-03-01 19:53:32.000000000 +0000

+++ cups-1.1.17/filter/hpgl-input.c	2004-12-17 10:19:51.378737854 +0000

@@ -54,7 +54,8 @@

 		ch,		/* Current char */

 		done,		/* Non-zero when the current command is read */

 		i;		/* Looping var */

-  char		buf[262144];	/* String buffer */

+  char		buf[262144],	/* String buffer */

+		*bufptr;	/* Pointer into buffer */

   static param_t p[MAX_PARAMS];	/* Parameter buffer */

@@ -115,9 +116,12 @@

   if (strcasecmp(name, "LB") == 0)

   {

-    for (i = 0; (ch = getc(fp)) != StringTerminator; i ++)

-      buf[i] = ch;

-    buf[i] = '\0';

+    bufptr = buf;

+    while ((ch = getc(fp)) != StringTerminator)

+      if (bufptr < (buf + sizeof(buf) - 1))

+        *bufptr++ = ch;

+    *bufptr = '\0';

+

     p[num_params].type         = PARAM_STRING;

     p[num_params].value.string = strdup(buf);

     num_params ++;

@@ -142,11 +146,12 @@

   }

   else if (strcasecmp(name, "PE") == 0)

   {

-    for (i = 0; i < (sizeof(buf) - 1); i ++)

-      if ((buf[i] = getc(fp)) == ';')

-        break;

+    bufptr = buf;

+    while ((ch = getc(fp)) != ';')

+      if (bufptr < (buf + sizeof(buf) - 1))

+        *bufptr++ = ch;

+    *bufptr = '\0';

-    buf[i] = '\0';

     p[num_params].type         = PARAM_STRING;

     p[num_params].value.string = strdup(buf);

     num_params ++;