Summary
A PWG Raster page with an unsupported color space makes pwgtopdf log Color space not supported and then crash through a null callback.
Reproduction
Build current upstream with ASan/UBSan. Start from a parseable one-page PWG Raster stream (2SaR / PwgRaster sync), retain a complete page header and minimal payload, then set cupsColorSpace to a value not supported by prepare_pdf_page().
ASAN_OPTIONS=detect_leaks=0 PPD=candidate.ppd CONTENT_TYPE=application/vnd.cups-pwg
pwgtopdf 1 fuzzer fuzzer 1 'Resolution=300dpi PageSize=Letter' document.pwg >/dev/null
Result
Reproduced through the real pwgtopdf CLI with an ASan/UBSan build from libcupsfilters HEAD d63939da08eaef622a2443b7c9638d22c4d9831d and libppd HEAD 522af8dd135f4dde66b1aac8b9d067808bbe122d on 2026-07-19. The filter logs cfFilterPWGToPDF: Color space not supported, then ASan reports a SEGV in convert_raster() at cupsfilters/pwgtopdf.c:1637, calling doc->bit_function.
Cause and expected behavior
prepare_pdf_page() returns an error without initializing conversion callbacks. add_pdf_page() ignores that result at cupsfilters/pwgtopdf.c:1491, and convert_raster() later calls doc->bit_function. Propagate the preparation failure and abort the job cleanly.
Summary
A PWG Raster page with an unsupported color space makes
pwgtopdflogColor space not supportedand then crash through a null callback.Reproduction
Build current upstream with ASan/UBSan. Start from a parseable one-page PWG Raster stream (
2SaR/PwgRastersync), retain a complete page header and minimal payload, then setcupsColorSpaceto a value not supported byprepare_pdf_page().Result
Reproduced through the real
pwgtopdfCLI with an ASan/UBSan build from libcupsfilters HEADd63939da08eaef622a2443b7c9638d22c4d9831dand libppd HEAD522af8dd135f4dde66b1aac8b9d067808bbe122don 2026-07-19. The filter logscfFilterPWGToPDF: Color space not supported, then ASan reports a SEGV inconvert_raster()atcupsfilters/pwgtopdf.c:1637, callingdoc->bit_function.Cause and expected behavior
prepare_pdf_page()returns an error without initializing conversion callbacks.add_pdf_page()ignores that result atcupsfilters/pwgtopdf.c:1491, andconvert_raster()later callsdoc->bit_function. Propagate the preparation failure and abort the job cleanly.