From a86bf06cd5adf3c14d9857454160f79a877e5e4e Mon Sep 17 00:00:00 2001 From: Armaan Sandhu Date: Mon, 2 Nov 2026 16:48:07 -0500 Subject: [PATCH] pdftops: don't crash on PDFTOPDF comments without a colon parse_pdftopdf_comment() did strchr(buf + 19, ':') + 1 on %%PDFTOPDFNumCopies and %%PDFTOPDFCollate lines without checking for NULL, so a line like "%%PDFTOPDFNumCopies 3" crashed the filter. Skip the line when there is no colon. An empty value ("%%PDFTOPDFNumCopies:" at the end of the file) also made the trailing-whitespace loop read before the start of deviceCopies. Keep the default copy count in that case. --- ppd/pdftops.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/ppd/pdftops.c b/ppd/pdftops.c index 0d0c1a27..d1ad2efd 100644 --- a/ppd/pdftops.c +++ b/ppd/pdftops.c @@ -148,22 +148,29 @@ parse_pdftopdf_comment(char *filename, // I - Input file { char *p; - p = strchr(buf + 19, ':') + 1; + if ((p = strchr(buf + 19, ':')) == NULL) + continue; + p ++; while (*p == ' ' || *p == '\t') p ++; - strncpy(deviceCopies, p, 31); - deviceCopies[31] = '\0'; - p = deviceCopies + strlen(deviceCopies) - 1; - while (*p == ' ' || *p == '\t' || *p == '\r' || *p == '\n') - p --; - *(p + 1) = '\0'; + if (*p && *p != '\r' && *p != '\n') + { + strncpy(deviceCopies, p, 31); + deviceCopies[31] = '\0'; + p = deviceCopies + strlen(deviceCopies) - 1; + while (*p == ' ' || *p == '\t' || *p == '\r' || *p == '\n') + p --; + *(p + 1) = '\0'; + } *pdftopdfapplied = 1; } else if (strncmp(buf, "%%PDFTOPDFCollate", 17) == 0) { char *p; - p = strchr(buf + 17, ':') + 1; + if ((p = strchr(buf + 17, ':')) == NULL) + continue; + p ++; while (*p == ' ' || *p == '\t') p ++; if (strncasecmp(p, "true", 4) == 0)