imagetops passes a NULL image to cfImageClose

Summary

When image opening fails, ppdFilterImageToPS() calls cfImageClose(img) while img == NULL. cfImageClose() immediately dereferences img->cachefile.

Reproduction

Build current upstream with ASan/UBSan. A compact binary PGM is sufficient to reach the image-open failure path in the tested build:

printf 'P5\n1 1\n255\n\001' > document.ppm
ASAN_OPTIONS=detect_leaks=0 PPD=candidate.ppd CONTENT_TYPE=image/x-portable-anymap 
  imagetops 1 fuzzer fuzzer 1 'Resolution=300dpi PageSize=Letter' document.ppm >/dev/null

Result

Reproduced through the real imagetops CLI with an ASan/UBSan build from libppd HEAD 522af8dd135f4dde66b1aac8b9d067808bbe122d and libcupsfilters HEAD d63939da08eaef622a2443b7c9638d22c4d9831d on 2026-07-19. ASan reports a SEGV in cupsfilters/image.c:75 (cfImageClose), called by ppd/imagetops-pstops.c:1181.

Cause and expected behavior

This is an error-cleanup bug: the image-open operation has already returned NULL, but its cleanup path dereferences that NULL value. Do not call cfImageClose for NULL, or make it tolerate NULL, and return a normal filter error.

Start in ppd/imagetops-pstops.c around line 1181, where ppdFilterImageToPS() cleans up after image opening fails, and inspect cupsfilters/image.c around line 75 for cfImageClose(). Reproduce with the supplied PGM, imagetops command, and ASan/UBSan build; done means the NULL cleanup no longer dereferences memory and imagetops returns a normal filter error.