[STR Closed w/o Resolution] The maximum dimensions of an image are 2^27-1, so it is impossible for "img->ysize * 3" to overflow a 32-bit integer. See the range checks prior to the buffer size check... Link: http://www.cups.org/str.php?L2974 Version: 1.3.9 Fix Version: None