From 46c5a98411970090cf37932aa253900ac361e9b9 Mon Sep 17 00:00:00 2001 From: Darren Carreras Date: Mon, 10 Aug 2026 12:50:54 -0400 Subject: [PATCH] Reject invalid custom page parameter types Custom PageSize processing consumes Width, Height, WidthOffset, and HeightOffset as point values and Orientation as an integer. Reject declarations with incompatible types before those values can be interpreted through the wrong union member. This prevents the disclosed Width string type confusion and applies the same invariant to the related custom page parameters. References: OSV-2026-551 --- cups/ppd.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/cups/ppd.c b/cups/ppd.c index 14b76483ed..c899a7ca28 100644 --- a/cups/ppd.c +++ b/cups/ppd.c @@ -1060,6 +1060,17 @@ _ppdOpen( goto error; } + if (!strcmp(coption->keyword, "PageSize") && + (((!strcmp(name, "Width") || !strcmp(name, "Height") || + !strcmp(name, "WidthOffset") || !strcmp(name, "HeightOffset")) && + cparam->type != PPD_CUSTOM_POINTS) || + (!strcmp(name, "Orientation") && cparam->type != PPD_CUSTOM_INT))) + { + pg->ppd_status = PPD_BAD_CUSTOM_PARAM; + + goto error; + } + /* * Now special-case for CustomPageSize... */