cfFilterPWGToPDF continues after page preparation fails
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 76/100
Research direction
Start in cupsfilters/pwgtopdf.c at add_pdf_page() around line 1491, then follow prepare_pdf_page() and convert_raster() around line 1637. Re-run the supplied ASan/UBSan pwgtopdf command with an unsupported cupsColorSpace; done means the preparation error is propagated and the job aborts cleanly without calling the null conversion callback.
Written by the indexing model from the issue text.
Description
Summary
A PWG Raster page with an unsupported color space makes pwgtopdf log Color space not supported and then crash through a null callback.
Reproduction
Build current upstream with ASan/UBSan. Start from a parseable one-page PWG Raster stream (2SaR / PwgRaster sync), retain a complete page header and minimal payload, then set cupsColorSpace to a value not supported by prepare_pdf_page().
ASAN_OPTIONS=detect_leaks=0 PPD=candidate.ppd CONTENT_TYPE=application/vnd.cups-pwg
pwgtopdf 1 fuzzer fuzzer 1 'Resolution=300dpi PageSize=Letter' document.pwg >/dev/null
Result
Reproduced through the real pwgtopdf CLI with an ASan/UBSan build from libcupsfilters HEAD d63939da08eaef622a2443b7c9638d22c4d9831d and libppd HEAD 522af8dd135f4dde66b1aac8b9d067808bbe122d on 2026-07-19. The filter logs cfFilterPWGToPDF: Color space not supported, then ASan reports a SEGV in convert_raster() at cupsfilters/pwgtopdf.c:1637, calling doc->bit_function.
Cause and expected behavior
prepare_pdf_page() returns an error without initializing conversion callbacks. add_pdf_page() ignores that result at cupsfilters/pwgtopdf.c:1491, and convert_raster() later calls doc->bit_function. Propagate the preparation failure and abort the job cleanly.
- Dominant language
- C
- Stars
- 17
- Forks
- 71
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 12
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from OpenPrinting/libcupsfilters
-
Difficulty 1/5 1-3 hours Newbie friendliness 85/100
OpenPrinting/libcupsfilters#222 · 2 comments · 1 reaction ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
OpenPrinting/libcupsfilters#196 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
OpenPrinting/libcupsfilters#180 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
OpenPrinting/libcupsfilters#179 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
OpenPrinting/libcupsfilters#174 ·
All issues in OpenPrinting/libcupsfilters
Similar issues
-
level/task module/gcp type/bug
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
Difficulty 1/5 Under an hour Newbie friendliness 86/100
hapostgres/pg_auto_failover#1190 ·
-
docs
Difficulty 1/5 Under an hour Newbie friendliness 85/100
-
P3 sonic-vpp
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
sonic-net/sonic-buildimage#29662 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 94/100
spack/spack-packages#6586 ·