diff options
| author | kcwu <kcwu@chromium.org> | 2016-09-22 12:56:23 -0700 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2016-09-22 12:56:23 -0700 |
| commit | 62356867b331bc9f71f9a0c8fce0cff9927d3356 (patch) | |
| tree | 0b4ef2bdb6432efab31c61241a9553c320faee99 | |
| parent | 869a4381b12dadfabe9750bd4d1a3867241917c8 (diff) | |
| download | pdfium-62356867b331bc9f71f9a0c8fce0cff9927d3356.tar.xz | |
Fix use uninitialized value and stack buffer overflow read
Found by libfuzzer
Review-Url: https://codereview.chromium.org/2362813002
| -rw-r--r-- | third_party/lcms2-2.6/0003-uninit.patch | 30 | ||||
| -rw-r--r-- | third_party/lcms2-2.6/README.pdfium | 1 | ||||
| -rw-r--r-- | third_party/lcms2-2.6/src/cmstypes.c | 5 |
3 files changed, 34 insertions, 2 deletions
diff --git a/third_party/lcms2-2.6/0003-uninit.patch b/third_party/lcms2-2.6/0003-uninit.patch new file mode 100644 index 0000000000..476007e776 --- /dev/null +++ b/third_party/lcms2-2.6/0003-uninit.patch @@ -0,0 +1,30 @@ +diff --git a/third_party/lcms2-2.6/src/cmstypes.c b/third_party/lcms2-2.6/src/cmstypes.c +index 06742b5..44c5b87 100644 +--- a/third_party/lcms2-2.6/src/cmstypes.c ++++ b/third_party/lcms2-2.6/src/cmstypes.c +@@ -2964,7 +2964,7 @@ void *Type_ColorantTable_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER + { + cmsUInt32Number i, Count; + cmsNAMEDCOLORLIST* List; +- char Name[34]; ++ char Name[33]; + cmsUInt16Number PCS[3]; + + +@@ -2979,7 +2979,7 @@ void *Type_ColorantTable_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER + for (i=0; i < Count; i++) { + + if (io ->Read(io, Name, 32, 1) != 1) goto Error; +- Name[33] = 0; ++ Name[32] = 0; + + if (!_cmsReadUInt16Array(io, 3, PCS)) goto Error; + +@@ -3106,6 +3106,7 @@ void *Type_NamedColor_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* i + + memset(Colorant, 0, sizeof(Colorant)); + if (io -> Read(io, Root, 32, 1) != 1) return NULL; ++ Root[32] = 0; + if (!_cmsReadUInt16Array(io, 3, PCS)) goto Error; + if (!_cmsReadUInt16Array(io, nDeviceCoords, Colorant)) goto Error; + diff --git a/third_party/lcms2-2.6/README.pdfium b/third_party/lcms2-2.6/README.pdfium index c15b2b1221..82bdbc60d3 100644 --- a/third_party/lcms2-2.6/README.pdfium +++ b/third_party/lcms2-2.6/README.pdfium @@ -12,4 +12,5 @@ Local Modifications: 0000-tag-type-confusion.patch: Fix a type confusion. 0001-from16-to-8-overflow.patch: Prevent a UBSan warning. 0002-infinite-loop-GrowNamedColorList.patch: Fix infinite loop when calling GrowNamedColorList. +0003-uninit.patch: Fix use uninitialized value and stack buffer overflow read. TODO(ochang): List other patches. diff --git a/third_party/lcms2-2.6/src/cmstypes.c b/third_party/lcms2-2.6/src/cmstypes.c index 06742b5ad6..44c5b87735 100644 --- a/third_party/lcms2-2.6/src/cmstypes.c +++ b/third_party/lcms2-2.6/src/cmstypes.c @@ -2964,7 +2964,7 @@ void *Type_ColorantTable_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER { cmsUInt32Number i, Count; cmsNAMEDCOLORLIST* List; - char Name[34]; + char Name[33]; cmsUInt16Number PCS[3]; @@ -2979,7 +2979,7 @@ void *Type_ColorantTable_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER for (i=0; i < Count; i++) { if (io ->Read(io, Name, 32, 1) != 1) goto Error; - Name[33] = 0; + Name[32] = 0; if (!_cmsReadUInt16Array(io, 3, PCS)) goto Error; @@ -3106,6 +3106,7 @@ void *Type_NamedColor_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* i memset(Colorant, 0, sizeof(Colorant)); if (io -> Read(io, Root, 32, 1) != 1) return NULL; + Root[32] = 0; if (!_cmsReadUInt16Array(io, 3, PCS)) goto Error; if (!_cmsReadUInt16Array(io, nDeviceCoords, Colorant)) goto Error; |