Add limits to PWG media dimension scaning.

Author: michaelrsweet

CHANGES.md

@@ -21,6 +21,7 @@ v2.4.21 - YYYY-MM-DD
 - Fixed unintended usage of C99 language feature (Issue #1742)
 - Fixed regression in mailto notifier address validation (Issue #1744)
 - Fixed regression with setting up temporary queues (Issue #1751)
+- Fixed a potential integer overflow with `pwgMediaForPWG`.
 
 
 v2.4.20 - 2026-10-05

cups/pwg-media.c

@@ -1,7 +1,7 @@
 /*
  * PWG media name API implementation for CUPS.
  *
- * Copyright © 2020-2024 by OpenPrinting.
+ * Copyright © 2020-2026 by OpenPrinting.
  * Copyright © 2009-2019 by Apple Inc.
  *
  * Licensed under Apache License v2.0.  See the file "LICENSE" for more
@@ -1203,10 +1203,14 @@ pwg_scan_measurement(
   * Scan integer portion...
   */
 
-  while (*buf >= '0' && *buf <= '9')
+  while (*buf >= '0' && *buf <= '9' && value < 100000)
     value = value * 10 + (*buf++) - '0';
 
-  if (*buf == '.')
+  if (*buf >= '0' && *buf <= '9')
+  {
+    return (INT_MAX);
+  }
+  else if (*buf == '.')
   {
    /*
     * Scan fractional portion...