libcupsfilters 2.2.0

[tillkamppeter]

First actual feature release after libcupsfilters 2.0.0 3 years ago: Done away with C++ using PDFio instead of QPDF and Poppler's pdftoppm instead of libpoppler, non-Latin plain text support, JPEG XL input support, print quality enhancement with Ghostscript, full-fledged CI testing for x86_64, ARM 32 and 64, RISC-V, and CUPS 2.x, 2.5.x, 3.x, bugs from security audit fixed, 4 CVEs fixed, and more ...

• Eliminated the use of C++ in libcupsfilters, to get all regular C

  • Replaced QPDF by PDFio as PDF manipulation library in libcupsfilters
    Modified the filter functions cfFilterPDFToPDF(), cfFilterPCLmToRaster(), cfFilterPWGToPDF(), cfFilterBannerToPDF(). Also turned the code from C++ into C.
  • In cfFilterPDFToRaster() replaced use of libpoppler by using PDFio and also the external executable pdftoppm of poppler-utils, Also here turned C++ code into C.
  • Made sure that the API/ABI of libcupsfilters did not change
  • Also added extra CI tests via cupsfilters/test-filter-cases.txt.
  • PDFio 1.6.4 now required for building libcupsfilters
    Older versions have bugs.
  • GSoC 2024 project of Uddhav Phatak: Final report
  • Thanks, Uddhav, for your excellent work!
  • Pull requests Replace QPDF by PDFio as PDF manipulation library in libcupsfilters  #71, Update build system and documentation for PDFio 1.6.0 #101, Fix for security vulnerablity due to system() function #103, Fix PCLm strip overflow and add regression test #105, fix to error due to execv #115, Fix to PDFio-based pdftopdf filter bugs #124, fix(pdftoraster): OOB read and NULL-ptr write in write_page_image() #146, Fix to BannertoPDF issues #154, Fix heap corruption via callback signature mismatch in cfFilterPCLmToRaster #171

• Non-Latin language input support for cfFilterTextToPDF()

  • Removed FC_MONO constraint to allow proportional fonts
    Some languages have non-monospaced scripts and now they can correctly load their intended fonts.
  • Default to UTF-8 when charset metadata is missing
    cfFilterTextToPDF() expects UTF-8 input by default now.
  • Add Devanagari Unicode range to utf-8 charsets
  • Thanks to Shreyansh Tiwari
  • Pull requests texttopdf: default to UTF-8 when charset metadata is missing #120, texttopdf: Remove FC_MONO constraint to allow proportional fonts #140, charset: Add Devanagari Unicode range to utf-8 charsets #141

• Added JPEG‑XL Support to libcupsfilters
  Now jobs in the high-quality JPEG-XL image format can be sent directly to CUPS and cfFilterImageTo...() filter functions read and convert these files.
  Winter of Code 4.0 project by Titiksha Bansal. Thanks a lot.
  (Pull request Add JPEG‑XL Support to libcupsfilters (WoC 4.0 Contribution) #82)

• Print quality improvements

  • In cfFilterGhostscript() introduced cupsHalftoneType dithering algorithms
    Controlled with halftone-type job option or cupsHalftoneType PPD option. Added stochastic halftoning, bi-level threshold, an algorithm from foo2zjs, 8x8, genordered, and spot from PDF (Pull request Ghostscript (gstoraster): Introduce cupsHalftoneType dithering algorithms #92, Ghostscript (gstoraster): new halftone/dithering algorithms #160)
  • Added user-settable gamma parameter and removed Ghostscript's default one.
  • Fixed 1-bit mono dithering of 100% black pixel.
    Prevents white holes in the text
  • Thanks to ValdikSS

• CI: Implemented complete GitHub Actions pipeline (Build, Unit tests, CodeQL, Cppcheck)

  • GitHub workflow for CI added
  • Static analysis (CodeQL, Cppcheck)
  • Build and unit tests multiple architecture (x86 64-bit, ARM 64- and 32-bit,
    and RISC-V 64-bit) and for different CUPS versions (2.4.x, 2.5.x, 3.x). Tests on 12 combos
  • Emulations used for ARM 32-bit and RISC-V
  • Use make check and also Debian's autopkgtests as unit tests
  • Workflows optimized with caching and parallel jobs
  • Fixed several issues disovered with the added static analysis
  • Part of Rohit Kumar's GSoC 2026 project. Thanks a lot.
  • Pull requests ci: implement complete GitHub Actions pipeline (Build, CodeQL, Cppcheck) #132, Fix static analysis warnings and memory leaks (cppcheck) #133, ci: add workflow_dispatch to allow manual CI runs #134, ci: Implement multi-architecture build and test workflow #135, fix: Remove accidentally re-introduced globalFlag block in testfilters.c #137, Run downstream Debian autopkgtests in CI via DESTDIR staging #157, Fix CUPS_VERSION_MAJOR typo and add CUPS_CFLAGS for libcups3 builds #158, Build against CUPS 2.4, 2.5 and 3.x; add 12-combination CI matrix #159

• CI: Improvements of unit tests

  • Add malformed PDF testcase for pdftopdf validation (Pull request tests: Add malformed PDF testcase for pdftopdf validation #131)
  • Added UTF-8 non-Latin regression coverage for Cyrillic, Greek, Arabic (Pull request tests: Add UTF-8 non-Latin regression coverage (Greek, Cyrillic, Arabic) #129)
  • Let testfilters just go through all lines of test cases instead of using line count as a parameter (Pull request tests: Fix testfilters to run loop till EOF instead of using line count logic #128)
  • Add optional manual FilterChain() support to testfilters
    Manually providing a filter chain is optional, if not supplied, it is set
    automatically as before (Pull request tests: Add optional manual FilterChain support to testfilters #122)
  • Added a deterministic build-time multipage UTF-8 Lorem-Ipsum generator (Pull request tests: add deterministic build-time multipage UTF-8 generator #119)
  • Thanks to Shreyansh Tiwari

• Fixed (crasher) bugs found in security audit by 7ASecurity

  • Crash from wrong tag *-supported/*-default attributes in the cfIPPAttrEnumValForPrinter() function
    Check IPP tags (data types) to avoid NULL derefences (OCU-01-001, Issue OCU-01-001 WP2: Crash via Wrong-Tag *-Supported Attributes (Medium) #149, pull request Fix crash from wrong-tag *-supported/*-default attributes (OCU-01-001) #162)
  • Crash from wrong-tag driverless IPP attributes
    cfGetBackSideOrientation() and cfGetPrintRenderIntent() look up several IPP attributes. Also here check tags/data types to avoid NULL derefences (OCU-01-003, Issue OCU-01-003 WP2: Crash via Wrong-Tag Driverless IPP Attributes (Medium) #163, pull request Fix crash from wrong-tag driverless IPP attributes (OCU-01-003) #164)
  • Thanks to Aayush Kumar for the GitHub issue reports and the fixes
  • And thanks to 7ASecurity for the audit and to the Sovereign Tech Agency for funding the Audit

• SECURITY: Out-of-bounds write in cfFilterPDFToRaster() if PDF has too
  large page dimensions.
  Crop dimensions to maximum allowed by standard, 14400x14400pt, 200x200in, 5x5m, if needed.
  (CVE-2025-64503)

• SECURITY: Vulnerabilities by image input with wrong color space/depth/bits-per-pixel combo.

  • Fix heap-buffer overflow write in cfImageLut
  • Reject color images with 1 bit per sample
  • Reject images where the number of samples does not correspond with the
    color space
  • Reject images with planar color configuration
  • Reject images with vertical scanlines

  (CVE-2025-57812)

• SECURITY: cfFilterImageTo...(): Added error handling for libpng and libjpeg function calls to avoid the process being aborted.
  (Pull request image-png.c: Handle libpng errors via longjmp()/setjmp() #168, image-jpeg.c: Handle jpeg errors as well #169)
  (CVE-2026-64612)

• SECURITY: Fix possible infinite loop when parsing device IDs, also avoid empty device IDs
  (Pull request ieee.c: Fix possible infinite loop and avoid empty device_ids #170)
  (CVE-2026-64611)

• Fixed heap buffer overflow in bilinear zoom of images
  (Issue Heap buffer overflow(read) in zoom_bilinear() #142, pull request image-zoom.c: Replace z_depth with z_inincr in zoom_bilinear() #143)

• Out-of-bounds read in NormalizeMakeModel when manufacturer name too long
  (Issue stack-buffer-overflow in cfIEEE1284NormalizeMakeModel() #136, pull request cupsfilters: ieee1284: fix out-of-bounds read in NormalizeMakeModel #139)

• Use ColorModel or output-mode if there's no print-color-mode
  (Issue ghostscript sigsegv (sig 11) with implicitclass:://... but works with socket or dnssd #126, pull request Use ColorModel or output-mode if there's no print-color-mode. Fixes #126 #127)

• Fix cache thrashing for large images when cropping them
  (Pull request Fix cache thrashing for large images #106)

• Fix for potential heap-buffer-overflow when reading TIFF images with more than one sample per pixel
  (Issue heap-buffer-overflow in _cfImageReadTIFF #107, pull request Potential heap-buffer-overflow fix #108)

• Unified return value of TIFF related functions to -1

• When zooming images check whether X and Y size dimensions are not zero
  (Pull request image-zoom.c: add the xsize and ysize check to zero in _cfImageZoomNew #86)

• pdftoraster, gsto..., mupdftopwg: Fix NULL-pointer dereference when parsing %%PDFTOPDF... comments
  (Pull request Fix NULL-pointer dereference when parsing %PDFTOPDF comments #94)

• pdftoraster: Check result of render_page() as it may return NULL if the page is not properly constructed
  (Pull request pdftoraster: Check result of render_page #95)

• imagetopdf: convert custom media size min_width and min_height to points
  (Issue Incorrect custom media dimensions #87, pull request imagetopdf: convert custom media size min_width and min_height to points. Fixes #87 #93)

• cfFilterChain(): Initialize return value to 0
  In some cases the function exits with non-zero status when all filters exit with no errors (zero status).

• Fixed Deadlock in filter chain When one filter fails
  (Issue Critical Issue: Deadlock in Filter Chain When One Filter Fails #32, pull request Fixed Issue #32: Deadlock in Filter Chain When One Filter Fails #85)

• cfFilterTextToPDF(): Let all Arabic characters be rendered right-to-left
  (Issue Arabic text generated by texttopdf is not RTL as it shoud be #84)

• Fix build with libcups3

  • Add additional changed function cupsParseOptions()
  • Only define struct cups_media_s if running a version older then CUPS 2.5.x
  • Update testfilters.c to use CUPS 3.0 API with compatibility shim for CUPS 2.x and older. Given that this is an end-user program, we don't want to include libcups2-private.h. Also tweaked Makefile to link against proper CUPS library.
  • Removed unused reference to cups/backend.h.
  • Pull request Fix build with CUPS 3.x #153

• Allow building without fontconfig.
  Controllable by ./configure option. When building without fontconfig, cfFilterTextToPDF() gets no-op (to keep API)
  (Pull request Allow building without fontconfig #83)

• Build-time option for alternative CJK font name.
  ./configure option -with-cjk-fonts sets alternative name
  (Pull request configure.ac: Make CJK fonts name configurable #96)

• Fix missing sys/stat.h include for Solaris
  (Issue Missing sys/stat.h header on Solaris #97, pull request Fix missing sys/stat.h include for Solaris #130)

• Use /bin/sh for testfilters.sh to avoid dependency on bash
  (Pull request Use /bin/sh for testfilters.sh to avoid dependency on bash #67)

• cfFilterImageToPDF(): Added extra debug log messages concerning page orientation
  (Pull request Fix landscape orientation issue #102)

---

This discussion was created from the release libcupsfilters 2.2.0.