Skip to content

ppd.c: Free existing strings on duplicate JCL and header keywords - #109

Merged
tillkamppeter merged 1 commit into
OpenPrinting:masterfrom
RonitMehta08:fix/ppd-duplicate-jcl-leak-fuzzing-46
Nov 14, 2026
Merged

tillkamppeter merged 1 commit into
OpenPrinting:masterfrom
RonitMehta08:fix/ppd-duplicate-jcl-leak-fuzzing-46

Conversation

@RonitMehta08

@RonitMehta08 RonitMehta08 commented Nov 13, 2026 •

Copy link
Copy Markdown
Contributor

Summary

When ppdOpenWithLocalization() (ppd/ppd.c) parses a PPD containing duplicate *JCLBegin, *JCLEnd, *JCLToPSInterpreter, *JCLToPDFInterpreter, *NickName, or *LanguageEncoding keywords, it calls strdup() and overwrites the struct member pointer without freeing the prior allocation, leaking the previous string.

Changes

  • Call free() on ppd->lang_encoding, ppd->nickname, ppd->jcl_begin, ppd->jcl_end, ppd->jcl_ps, and ppd->jcl_pdf (#if HAVE_CUPS_3_X) before reassigning them in ppdOpenWithLocalization().
  • Add regression test T47 in ppd/test_ppd_emit.c verifying that a PPD with duplicate *JCLBegin, *JCLEnd, *JCLToPSInterpreter, *NickName, and *LanguageEncoding keywords retains the latest decoded values and closes cleanly with zero leaks under AddressSanitizer / LeakSanitizer.

Fixes OpenPrinting/fuzzing#46

In ppdOpenWithLocalization(), free any previously allocated string before overwriting ppd->lang_encoding, ppd->nickname, ppd->jcl_begin, ppd->jcl_end, ppd->jcl_ps, and ppd->jcl_pdf when duplicate keywords appear in a PPD file.

Add regression test T47 in ppd/test_ppd_emit.c verifying that duplicate JCLBegin, JCLEnd, JCLToPSInterpreter, NickName, and LanguageEncoding lines retain the final decoded values without leaking memory under LeakSanitizer.

Fixes OpenPrinting/fuzzing#46

Signed-off-by: Ronit Mehta <ronitdmehta@gmail.com>
@tillkamppeter
tillkamppeter merged commit bbc4acb into OpenPrinting:master Nov 14, 2026
15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Memory leak in PPD parser when processing duplicate JCLBegin/JCLEnd keywords

2 participants