From 5de694bcd568af0470aa74d003a6eced5b30da14 Mon Sep 17 00:00:00 2001
From: Zdenek Dohnal <zdohnal@redhat.com>
Date: Fri, 12 Jan 2024 11:05:17 +0100
Subject: [PATCH] Backport fix for crash in ppdEmitString()

---
 CHANGES.md      | 1 +
 cups/ppd-emit.c | 7 ++++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/CHANGES.md b/CHANGES.md
index 39be7d4ce5..7ab6ca8952 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -16,6 +16,7 @@ Changes in CUPS v2.4.8 (TBA)
 - Fixed setting job state reasons for successful jobs (Issue #832)
 - Added additional check on socket if `revents` from `poll()` returns POLLHUP
   together with POLLIN or POLLOUT in `httpAddrConnect2()` (Issue #839)
+- Fixed crash in `ppdEmitString()` if `size` is NULL (Issue #850)
 - Fixed IPP backend to support the "print-scaling" option with IPP printers
   (Issue #862)
 
diff --git a/cups/ppd-emit.c b/cups/ppd-emit.c
index c7bff4d05e..1b9b4559dd 100644
--- a/cups/ppd-emit.c
+++ b/cups/ppd-emit.c
@@ -893,7 +893,12 @@ ppdEmitString(ppd_file_t    *ppd,	/* I - PPD file record */
         strlcpy(bufptr, "%%BeginFeature: *CustomPageSize True\n", (size_t)(bufend - bufptr + 1));
         bufptr += 37;
 
-        size = ppdPageSize(ppd, "Custom");
+        if ((size = ppdPageSize(ppd, "Custom")) == NULL)
+        {
+          free(buffer);
+          free(choices);
+          return (NULL);
+        }
 
         memset(values, 0, sizeof(values));