Summary
cfFilterPWGToRaster() accepts a PWG Raster page header with a zero HWResolution component, then performs modulo/division using it while calculating output scaling.
Reproduction
Build current upstream with ASan/UBSan. Start from a one-page PWG Raster stream (2SaR / PwgRaster sync), retain a parseable header and one byte of gray pixel data, then set the input page HWResolution to [0, 76800]. The tested page is 1 x 1, 8-bit gray; the PPD requests a normal 300-dpi output page.
ASAN_OPTIONS=detect_leaks=0 PPD=candidate.ppd CONTENT_TYPE=application/vnd.cups-pwg
pwgtoraster 1 fuzzer fuzzer 1 'PageSize=Small MediaType=Plain Duplex=None' document.pwg >/dev/null
Result
Reproduced through the real pwgtoraster CLI with an ASan/UBSan build from libcupsfilters HEAD d63939da08eaef622a2443b7c9638d22c4d9831d and libppd HEAD 522af8dd135f4dde66b1aac8b9d067808bbe122d on 2026-07-19. ASan/UBSan reports an FPE in cupsfilters/pwgtoraster.c:1620:
if (doc->outheader.HWResolution[i] % doc->inheader.HWResolution[i])
Cause and expected behavior
Reject zero input or output resolution before modulo or division. The malformed page header is accepted before out_page() uses the unchecked component.
Summary
cfFilterPWGToRaster()accepts a PWG Raster page header with a zeroHWResolutioncomponent, then performs modulo/division using it while calculating output scaling.Reproduction
Build current upstream with ASan/UBSan. Start from a one-page PWG Raster stream (
2SaR/PwgRastersync), retain a parseable header and one byte of gray pixel data, then set the input pageHWResolutionto[0, 76800]. The tested page is1 x 1, 8-bit gray; the PPD requests a normal 300-dpi output page.Result
Reproduced through the real
pwgtorasterCLI with an ASan/UBSan build from libcupsfilters HEADd63939da08eaef622a2443b7c9638d22c4d9831dand libppd HEAD522af8dd135f4dde66b1aac8b9d067808bbe122don 2026-07-19. ASan/UBSan reports an FPE incupsfilters/pwgtoraster.c:1620:Cause and expected behavior
Reject zero input or output resolution before modulo or division. The malformed page header is accepted before
out_page()uses the unchecked component.