Summary
When image opening fails, ppdFilterImageToPS() calls cfImageClose(img) while img == NULL. cfImageClose() immediately dereferences img->cachefile.
Reproduction
Build current upstream with ASan/UBSan. A compact binary PGM is sufficient to reach the image-open failure path in the tested build:
printf 'P5\n1 1\n255\n\001' > document.ppm
ASAN_OPTIONS=detect_leaks=0 PPD=candidate.ppd CONTENT_TYPE=image/x-portable-anymap
imagetops 1 fuzzer fuzzer 1 'Resolution=300dpi PageSize=Letter' document.ppm >/dev/null
Result
Reproduced through the real imagetops CLI with an ASan/UBSan build from libppd HEAD 522af8dd135f4dde66b1aac8b9d067808bbe122d and libcupsfilters HEAD d63939da08eaef622a2443b7c9638d22c4d9831d on 2026-07-19. ASan reports a SEGV in cupsfilters/image.c:75 (cfImageClose), called by ppd/imagetops-pstops.c:1181.
Cause and expected behavior
This is an error-cleanup bug: the image-open operation has already returned NULL, but its cleanup path dereferences that NULL value. Do not call cfImageClose for NULL, or make it tolerate NULL, and return a normal filter error.
Summary
When image opening fails,
ppdFilterImageToPS()callscfImageClose(img)whileimg == NULL.cfImageClose()immediately dereferencesimg->cachefile.Reproduction
Build current upstream with ASan/UBSan. A compact binary PGM is sufficient to reach the image-open failure path in the tested build:
Result
Reproduced through the real
imagetopsCLI with an ASan/UBSan build from libppd HEAD522af8dd135f4dde66b1aac8b9d067808bbe122dand libcupsfilters HEADd63939da08eaef622a2443b7c9638d22c4d9831don 2026-07-19. ASan reports a SEGV incupsfilters/image.c:75(cfImageClose), called byppd/imagetops-pstops.c:1181.Cause and expected behavior
This is an error-cleanup bug: the image-open operation has already returned NULL, but its cleanup path dereferences that NULL value. Do not call
cfImageClosefor NULL, or make it tolerate NULL, and return a normal filter error.