Calculate actual size of number values when exporting, and fix argument to _cupsStrFormatd.

Author: michaelrsweet

CHANGES.md

@@ -8,6 +8,7 @@ v3.0.2 - YYYY-MM-DD
   generated test page content from 1 to 9600dpi.
 - Fixed a recursion issue with encoding of nested collections.
 - Fixed a potential margin issue when generating A4 PCL from `ipptransform`.
+- Fixed exporting of JSON with very large numbers.
 
 
 v3.0.1 - 2026-04-09

cups/json.c

@@ -1,7 +1,7 @@
 //
 // JSON API implementation for CUPS.
 //
-// Copyright © 2022-2025 by OpenPrinting.
+// Copyright © 2022-2026 by OpenPrinting.
 //
 // Licensed under Apache License v2.0.  See the file "LICENSE" for more
 // information.
@@ -226,7 +226,9 @@ cupsJSONExportString(cups_json_t *json)	// I - JSON root node
   cups_json_t	*current;		// Current node
   size_t	length;			// Length of JSON data as a string
   char		*s,			// JSON string
-		*ptr;			// Pointer into string
+		*ptr,			// Pointer into string
+		*end,			// End of string
+		temp[1024];		// Temporary string
   const char	*value;			// Pointer into string value
   struct lconv	*loc;			// Locale data
 
@@ -244,6 +246,7 @@ cupsJSONExportString(cups_json_t *json)	// I - JSON root node
   // Figure out the necessary space needed in the string
   current = json;
   length  = 1;				// nul
+  loc     = localeconv();
 
   while (current)
   {
@@ -267,7 +270,8 @@ cupsJSONExportString(cups_json_t *json)	// I - JSON root node
           break;
 
       case CUPS_JTYPE_NUMBER :
-          length += 32;
+	  _cupsStrFormatd(temp, temp + sizeof(temp) - 1, current->value.number, loc);
+	  length += strlen(temp);
           break;
 
       case CUPS_JTYPE_KEY :
@@ -327,7 +331,7 @@ cupsJSONExportString(cups_json_t *json)	// I - JSON root node
 
   current = json;
   ptr     = s;
-  loc     = localeconv();
+  end     = s + length - 1;
 
   while (current)
   {
@@ -362,11 +366,14 @@ cupsJSONExportString(cups_json_t *json)	// I - JSON root node
           break;
 
       case CUPS_JTYPE_OBJECT :
+          if (ptr >= end)
+            goto overflow;
+
           *ptr++ = '{';
           break;
 
       case CUPS_JTYPE_NUMBER :
-          _cupsStrFormatd(ptr, s + length, current->value.number, loc);
+          _cupsStrFormatd(ptr, end, current->value.number, loc);
           ptr += strlen(ptr);
           break;
 
@@ -471,6 +478,13 @@ cupsJSONExportString(cups_json_t *json)	// I - JSON root node
   DEBUG_printf("3cupsJSONExportString: Returning \"%s\".", s);
 
   return (s);
+
+  // If we get here we overflowed our string buffer for some reason...
+  overflow:
+
+  free(s);
+
+  return (NULL);
 }