Repository navigation
imagetops passes a NULL image to cfImageClose #79
Description
Summary
When image opening fails, ppdFilterImageToPS() calls cfImageClose(img) while img == NULL. cfImageClose() immediately dereferences img->cachefile.
Reproduction
Build current upstream with ASan/UBSan. A compact binary PGM is sufficient to reach the image-open failure path in the tested build:
printf 'P5\n1 1\n255\n\001' > document.ppm
ASAN_OPTIONS=detect_leaks=0 PPD=candidate.ppd CONTENT_TYPE=image/x-portable-anymap
imagetops 1 fuzzer fuzzer 1 'Resolution=300dpi PageSize=Letter' document.ppm >/dev/nullResult
Reproduced through the real imagetops CLI with an ASan/UBSan build from libppd HEAD 522af8dd135f4dde66b1aac8b9d067808bbe122d and libcupsfilters HEAD d63939da08eaef622a2443b7c9638d22c4d9831d on 2026-07-19. ASan reports a SEGV in cupsfilters/image.c:75 (cfImageClose), called by ppd/imagetops-pstops.c:1181.
Cause and expected behavior
This is an error-cleanup bug: the image-open operation has already returned NULL, but its cleanup path dereferences that NULL value. Do not call cfImageClose for NULL, or make it tolerate NULL, and return a normal filter error.
Activity
kimaiden1984-boop commentedon Jul 19, 2026
Exact reproduction files:
Decode candidate.ppd and document.ppm