Reject invalid custom page parameter types

[carrerasdarren-cell]

Summary

• reject ParamCustomPageSize Width, Height, WidthOffset, and HeightOffset declarations unless their type is points
• reject ParamCustomPageSize Orientation unless its type is int
• keep the change confined to the PPD loader, without adding a permanent test fixture

Root cause

Custom PageSize processing consumes Width, Height, WidthOffset, and HeightOffset through the custom_points union member and Orientation through custom_int. A malformed PPD can declare one of those parameters with an incompatible pointer-backed type. For Width, the disclosed OSS-Fuzz testcase causes ppdPageSize() to overwrite the pointer union member with float bits, and ppdClose() later passes those bits to free().

Rejecting incompatible types during parsing prevents the union type confusion and applies the same invariant to the related custom page parameters.

Verification

• disclosed OSS-Fuzz Width testcase: rejected with Bad custom parameter, with no AddressSanitizer fault
• reduced Width testcase: rejected with Bad custom parameter, with no AddressSanitizer fault
• local review matrix: malformed Width, Height, WidthOffset, HeightOffset, and Orientation declarations were all rejected
• valid control with four points parameters and integer Orientation was accepted
• complete cups/testppd focused suite: all checks passed under AddressSanitizer
• git diff --check

References: OSV-2026-551 / OSS-Fuzz issue 500762221

[michaelrsweet]

I think we can do without the unit test changes (this isn't a common issue and if the PPD loader rejects the file that is sufficient...)

WRT the custom parameter checks, we should also check that WidthOffset and HeightOffset are also points and that Orientation is PPD_CUSTOM_INT.

[carrerasdarren-cell]

Addressed in 46c5a984: removed the Makefile, fixture, and testppd.c changes; extended the loader check so Width, Height, WidthOffset, and HeightOffset require PPD_CUSTOM_POINTS, while Orientation requires PPD_CUSTOM_INT. The ASan testppd suite passes, all five malformed local review cases are rejected with PPD_BAD_CUSTOM_PARAM, and a correctly typed control is accepted.