imagetops passes a NULL image to cfImageClose

Open Beginner friendly
#79 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
c
Domain
cli

Research direction

Start in ppd/imagetops-pstops.c around line 1181, where ppdFilterImageToPS() cleans up after image opening fails, and inspect cupsfilters/image.c around line 75 for cfImageClose(). Reproduce with the supplied PGM, imagetops command, and ASan/UBSan build; done means the NULL cleanup no longer dereferences memory and imagetops returns a normal filter error.

Written by the indexing model from the issue text.

Description

Summary

When image opening fails, ppdFilterImageToPS() calls cfImageClose(img) while img == NULL. cfImageClose() immediately dereferences img->cachefile.

Reproduction

Build current upstream with ASan/UBSan. A compact binary PGM is sufficient to reach the image-open failure path in the tested build:

printf 'P5\n1 1\n255\n\001' > document.ppm
ASAN_OPTIONS=detect_leaks=0 PPD=candidate.ppd CONTENT_TYPE=image/x-portable-anymap 
  imagetops 1 fuzzer fuzzer 1 'Resolution=300dpi PageSize=Letter' document.ppm >/dev/null

Result

Reproduced through the real imagetops CLI with an ASan/UBSan build from libppd HEAD 522af8dd135f4dde66b1aac8b9d067808bbe122d and libcupsfilters HEAD d63939da08eaef622a2443b7c9638d22c4d9831d on 2026-07-19. ASan reports a SEGV in cupsfilters/image.c:75 (cfImageClose), called by ppd/imagetops-pstops.c:1181.

Cause and expected behavior

This is an error-cleanup bug: the image-open operation has already returned NULL, but its cleanup path dereferences that NULL value. Do not call cfImageClose for NULL, or make it tolerate NULL, and return a normal filter error.

Dominant language
C
Stars
5
Forks
29
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from OpenPrinting/libppd

All issues in OpenPrinting/libppd

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.