libcupsfilters 2.1.2

[tillkamppeter]

Due to regressions in the transition from QPDF to PDFio (PR #71) in release 2.2.1 we have issued this 2.1.2 release containing everything of 2.1.1 except the transition from QPDF to PDFio, plus some fixes which have appeared after the 2.2.1 release. This release especially makes all fixes available which were done after the 2.1.1 release 1.5 years ago.

• Non-Latin language input support for cfFilterTextToPDF()
  • Removed FC_MONO constraint to allow proportional fonts. Some languages have non-monospaced scripts and now they can correctly load their intended fonts.
  • Default to UTF-8 when charset metadata is missing. cfFilterTextToPDF() expects UTF-8 input by default now.
  • Add Devanagari Unicode range to utf-8 charsets
  • Thanks to Shreyansh Tiwari
  • Pull requests texttopdf: default to UTF-8 when charset metadata is missing #120, texttopdf: Remove FC_MONO constraint to allow proportional fonts #140, charset: Add Devanagari Unicode range to utf-8 charsets #141
• Added JPEG‑XL Support to libcupsfilters. Now jobs in the high-quality JPEG-XL image format can be sent directly to CUPS and cfFilterImageTo...() filter functions read and convert these files.
  Winter of Code 4.0 project by Titiksha Bansal. Thanks a lot.
  (Pull request Add JPEG‑XL Support to libcupsfilters (WoC 4.0 Contribution) #82)
• Print quality improvements
  • In cfFilterGhostscript() introduced cupsHalftoneType dithering algorithms. Controlled with halftone-type job option or cupsHalftoneType PPD option. Added stochastic halftoning, bi-level threshold, and an algorithm from foo2zjs, 8x8, genordered, and spot from PDF (Pull request Ghostscript (gstoraster): Introduce cupsHalftoneType dithering algorithms #92, Ghostscript (gstoraster): new halftone/dithering algorithms #160)
  • Added user-settable gamma parameter and remove Ghostscript's default one.
  • Fixed 1-bit mono dithering of 100% black pixel. Prevents white holes in the text
  • Thanks to ValdikSS
• CI: Implemented complete GitHub Actions pipeline (Build, Unit tests, CodeQL, Cppcheck)
  • GitHub workflow for CI added
  • Static analysis (CodeQL, Cppcheck)
  • Build and unit tests multiple architecture (x86 64-bit, ARM 64- and 32-bit, and RISC-V 64-bit) and for different CUPS versions (2.4.x, 2.5.x, 3.x). Tests on 12 combos
  • Emulations used for ARM 32-bit and RISC-V
  • Use make check and also Debian's autopkgtests as unit tests
  • Workflows optimized with caching and parallel jobs
  • Fixed several issues discovered with the added static analysis
  • Temporarily set cppcheck test to never fail as it fails without any "error" class issue reported
  • Part of Rohit Kumar's GSoC 2026 project. Thanks a lot.
  • Pull requests ci: implement complete GitHub Actions pipeline (Build, CodeQL, Cppcheck) #132, Fix static analysis warnings and memory leaks (cppcheck) #133, ci: add workflow_dispatch to allow manual CI runs #134, ci: Implement multi-architecture build and test workflow #135, fix: Remove accidentally re-introduced globalFlag block in testfilters.c #137, Run downstream Debian autopkgtests in CI via DESTDIR staging #157, Fix CUPS_VERSION_MAJOR typo and add CUPS_CFLAGS for libcups3 builds #158, Build against CUPS 2.4, 2.5 and 3.x; add 12-combination CI matrix #159
• CI: Improvements of unit tests
  • Add malformed PDF testcase for pdftopdf validation (Pull request tests: Add malformed PDF testcase for pdftopdf validation #131)
  • Added UTF-8 non-Latin regression coverage for Cyrillic, Greek, Arabic (Pull request tests: Add UTF-8 non-Latin regression coverage (Greek, Cyrillic, Arabic) #129)
  • Let testfilters just go through all lines of test cases instead of using
    line count as a parameter (Pull request tests: Fix testfilters to run loop till EOF instead of using line count logic #128)
  • Add optional manual FilterChain() support to testfilters. Manually providing a filter chain is optional, if not supplied, it is set automatically as before (Pull request tests: Add optional manual FilterChain support to testfilters #122)
  • Added a deterministic build-time multipage UTF-8 lorem generator (Pull request tests: add deterministic build-time multipage UTF-8 generator #119)
  • Added CI test test-pclm-overflow.sh for PCLm strip overflow, skip (exit 77) when AddressSanitizer is unavailable, also temporarily use "new-delete-type-mismatch" option, as there are delete-type-mismatch errors only on some architectures and locally not reproducible (Issue 2.2.0: test failures / release tarballs are missing test-pdftoraster-copy-height.c #200, Pull requests Fix PCLm strip overflow and add regression test #105, Fix 2.2.0 test packaging and CUPS datadir detection (#200, #201) #204).
  • Thanks to Shreyansh Tiwari
• Fixed (crasher) bugs found in security audit by 7ASecurity
  • Crash by a crafted PNG input file extremely large in one dimension. Cap PNG dimensions to avoid memory exhaustion (OCU-01-016, Issue OCU-01-016 WP3: Memory Exhaustion via Interlaced PNG (Medium) #215, pull request Cap PNG dimensions to avoid memory exhaustion (OCU-01-016) #216)
  • Crash from wrong tag *-supported/*-default attributes, in the cfIPPAttrEnumValForPrinter() function. Check IPP tags (data types) to avoid NULL dereferences (OCU-01-001, Issue OCU-01-001 WP2: Crash via Wrong-Tag *-Supported Attributes (Medium) #149, pull request Fix crash from wrong-tag *-supported/*-default attributes (OCU-01-001) #162)
  • Crash from wrong-tag driverless IPP attributes. cfGetBackSideOrientation() and cfGetPrintRenderIntent() look up several IPP attributes. Also here check tags/data types to avoid NULL dereferences (OCU-01-003, Issue OCU-01-003 WP2: Crash via Wrong-Tag Driverless IPP Attributes (Medium) #163, pull request Fix crash from wrong-tag driverless IPP attributes (OCU-01-003) #164)
  • Thanks to Aayush Kumar
• SECURITY: Out-of-bounds write in cfFilterPDFToRaster() if PDF has too large page dimensions. Crop dimensions to maximum allowed by standard, 14400x14400pt, 200x200in, 5x5m, if needed.
  (CVE-2025-64503)
• SECURITY: Vulnerabilities by image input with wrong color space/depth/bits-per-pixel combo.
  • Fix heap-buffer overflow write in cfImageLut
  • Reject color images with 1 bit per sample
  • Reject images where the number of samples does not correspond with the
    color space
  • Reject images with planar color configuration
  • Reject images with vertical scanlines
  • (CVE-2025-57812)
• SECURITY: cfFilterImageTo...(): Added error handling for libpng and libjpeg function calls to avoid the process being aborted. (Pull request image-png.c: Handle libpng errors via longjmp()/setjmp() #168, image-jpeg.c: Handle jpeg errors as well #169)
  (CVE-2026-64612)
• SECURITY: Fix possible infinite loop when parsing device IDs, also avoid empty device IDs (Pull request ieee.c: Fix possible infinite loop and avoid empty device_ids #170)
  (CVE-2026-64611)
• pclmtoraster: Treat realloc() failures correctly, freeing the allocated memory. Found by the cppcheck analyzer
• cfFilterGhostscript(): Serialize raster integer parameters as signed integers (Issue cfFilterGhostscript fails with rangecheck when PPD sets cupsCompression=-1 #218, cfFilterGhostscript: duplex DM3 (Rotated) emits -dcupsInteger1=4294967295; Ghostscript appleraster rangecheck #222, pull request ghostscript: serialize raster integer parameters as signed #225)
• pwgtoraster: Reject overflowing raster buffers (Issue pwgtoraster: horizontal replication undersizes the input row #192, pwgtoraster: planar page-buffer multiplication wraps to zero #193, pwgtoraster: vertical averaging size wraps before heap allocation #194, pull request pwgtoraster: reject overflowing raster buffers #210)
• Fixed heap buffer overflow in bilinear zoom of images (Issue Heap buffer overflow(read) in zoom_bilinear() #142, pull request image-zoom.c: Replace z_depth with z_inincr in zoom_bilinear() #143)
• Out-of-bounds read in NormalizeMakeModel when manufacturer name too long (Issue stack-buffer-overflow in cfIEEE1284NormalizeMakeModel() #136, pull request cupsfilters: ieee1284: fix out-of-bounds read in NormalizeMakeModel #139)
• Use ColorModel or output-mode if there's no print-color-mode (Issue ghostscript sigsegv (sig 11) with implicitclass:://... but works with socket or dnssd #126, pull request Use ColorModel or output-mode if there's no print-color-mode. Fixes #126 #127)
• Fix cache thrashing for large images when cropping them (Pull request Fix cache thrashing for large images #106)
• Fix for potential heap-buffer-overflow when reading TIFF images with more than one sample per pixel (Issue heap-buffer-overflow in _cfImageReadTIFF #107, pull request Potential heap-buffer-overflow fix #108)
• Unified return value of TIFF related functions to -1
• When zooming images check whether X and Y size dimensions are not zero (Pull request image-zoom.c: add the xsize and ysize check to zero in _cfImageZoomNew #86)
• pdftoraster, gsto..., mupdftopwg: Fix NULL-pointer dereference when parsing %%PDFTOPDF... comments (Pull request Fix NULL-pointer dereference when parsing %PDFTOPDF comments #94)
• pdftoraster: Check result of render_page() as it may return NULL if the page is not properly constructed (Pull request pdftoraster: Check result of render_page #95)
• imagetopdf: convert custom media size min_width and min_height to points (Issue Incorrect custom media dimensions #87, pull request imagetopdf: convert custom media size min_width and min_height to points. Fixes #87 #93)
• cfFilterChain(): Initialize return value to 0. In some cases the function exits with non-zero status when all filters exit with no errors (zero status).
• Fixed deadlock in filter chain when one filter fails (Issue Critical Issue: Deadlock in Filter Chain When One Filter Fails #32, pull request Fixed Issue #32: Deadlock in Filter Chain When One Filter Fails #85)
• cfFilterTextToPDF(): Let all Arabic characters be rendered right-to-left (Issue Arabic text generated by texttopdf is not RTL as it shoud be #84)
• Fix build with libcups3
  • Add additional changed function cupsParseOptions()
  • Update testfilters.c to use CUPS 3.0 API with compatibility shim for CUPS 2.x and older. Given that this is an end-user program, we don't want to include libcups2-private.h. Also tweaked Makefile to link against proper CUPS library.
  • Removed unused reference to cups/backend.h.
  • Pull request Fix build with CUPS 3.x #153
• Allow building without fontconfig. Controllable by ./configure option. When building without fontconfig, cfFilterTextToPDF() gets no-op (to keep API) (Pull request Allow building without fontconfig #83)
• Build-time option for alternative CJK font name. ./configure option --with-cjk-fonts sets alternative name (Pull request configure.ac: Make CJK fonts name configurable #96)
• Build system: Get CUPS_DATADIR from the .pc cups_datadir variable, not from $prefix/share/cups (wrong under an arch-specific CUPS prefix); fallback kept (Issue 2.2.0: cups datadir handling pkgconfig vs. cups-config #201, Pull request Fix 2.2.0 test packaging and CUPS datadir detection (#200, #201) #204).
• Build system: Ensure gen-lorem-text test supports out of tree builds, creating needed directory (Pull request Makefile.am: Ensure gen-lorem-text test supports out of tree builds #205).
• Fix missing sys/stat.h include for Solaris (Issue Missing sys/stat.h header on Solaris #97, pull request Fix missing sys/stat.h include for Solaris #130)
• Use /bin/sh for testfilters.sh to avoid dependency on bash (Pull request Use /bin/sh for testfilters.sh to avoid dependency on bash #67)
• cfFilterImageToPDF(): Added extra debug log messages concerning page orientation (Pull request Fix landscape orientation issue #102)

---

This discussion was created from the release libcupsfilters 2.1.2.