diff -up cups-filters-1.0.35/filter/textcommon.c.CVE-2015-3258-3279 cups-filters-1.0.35/filter/textcommon.c
--- cups-filters-1.0.35/filter/textcommon.c.CVE-2015-3258-3279	2013-05-07 19:24:58.000000000 +0100
+++ cups-filters-1.0.35/filter/textcommon.c	2015-07-09 08:16:32.506423028 +0100
@@ -26,6 +26,7 @@
  */
 
 #include "textcommon.h"
+#include <limits.h>
 
 
 /*
@@ -644,6 +645,45 @@ TextMain(const char *name,	/* I - Name o
   if (PrettyPrint)
     PageTop -= 216.0f / LinesPerInch;
 
+ /*
+  * Allocate memory for the page...
+  */
+
+  SizeColumns = (PageRight - PageLeft) / 72.0 * CharsPerInch;
+  SizeLines   = (PageTop - PageBottom) / 72.0 * LinesPerInch;
+
+ /*
+  * Enforce minimum size...
+  */
+  if (SizeColumns < 1)
+    SizeColumns = 1;
+  if (SizeLines < 1)
+    SizeLines = 1;
+
+  if (SizeLines >= INT_MAX / SizeColumns / sizeof(lchar_t))
+  {
+    fprintf(stderr, "ERROR: bad page size\n");
+    exit(1);
+  }
+
+  Page    = calloc(sizeof(lchar_t *), SizeLines);
+  if (!Page)
+  {
+    fprintf(stderr, "ERROR: cannot allocate memory for page\n");
+    exit(1);
+  }
+
+  Page[0] = calloc(sizeof(lchar_t), SizeColumns * SizeLines);
+  if (!Page[0])
+  {
+    free(Page);
+    fprintf(stderr, "ERROR: cannot allocate memory for page\n");
+    exit(1);
+  }
+
+  for (i = 1; i < SizeLines; i ++)
+    Page[i] = Page[0] + i * SizeColumns;
+
   Copies = atoi(argv[4]);
 
   WriteProlog(argv[3], argv[2], getenv("CLASSIFICATION"),
@@ -1122,6 +1162,8 @@ TextMain(const char *name,	/* I - Name o
   if (ppd != NULL)
     ppdClose(ppd);
 
+  free(Page[0]);
+  free(Page);
   return (0);
 }
 
diff -up cups-filters-1.0.35/filter/texttopdf.c.CVE-2015-3258-3279 cups-filters-1.0.35/filter/texttopdf.c
--- cups-filters-1.0.35/filter/texttopdf.c.CVE-2015-3258-3279	2015-07-09 08:16:12.266663237 +0100
+++ cups-filters-1.0.35/filter/texttopdf.c	2015-07-09 08:16:32.506423028 +0100
@@ -172,9 +172,6 @@ WriteEpilogue(void)
 		{ "FN","FB","FI" };
   int i,j;
 
-  free(Page[0]);
-  free(Page);
-
   // embed fonts
   for (i = PrettyPrint ? 2 : 1; i >= 0; i --) {
     for (j = 0; j < NumFonts; j ++) 
@@ -333,18 +330,6 @@ WriteProlog(const char *title,		/* I - T
     PageTop    -= 36;
   }
 
- /*
-  * Allocate memory for the page...
-  */
-
-  SizeColumns = (PageRight - PageLeft) / 72.0 * CharsPerInch;
-  SizeLines   = (PageTop - PageBottom) / 72.0 * LinesPerInch;
-
-  Page    = calloc(sizeof(lchar_t *), SizeLines);
-  Page[0] = calloc(sizeof(lchar_t), SizeColumns * SizeLines);
-  for (i = 1; i < SizeLines; i ++)
-    Page[i] = Page[0] + i * SizeColumns;
-
   if (PageColumns > 1)
   {
     ColumnGutter = CharsPerInch / 2;