diff options
| author | kcwu <kcwu@chromium.org> | 2016-09-22 11:45:50 -0700 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2016-09-22 11:45:50 -0700 |
| commit | 869a4381b12dadfabe9750bd4d1a3867241917c8 (patch) | |
| tree | 4570d85e433337653766287d8b96f8e3e5c33f9b | |
| parent | fef62e1f2bbf064100e6e262a10653f2374bfd2b (diff) | |
| download | pdfium-869a4381b12dadfabe9750bd4d1a3867241917c8.tar.xz | |
Fix infinite loop when calling GrowNamedColorList
Handle the case that GrowNamedColorList return fail when list is too
long. Otherwise the loop never ends.
Found by libfuzzer
Review-Url: https://codereview.chromium.org/2365663002
| -rw-r--r-- | third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch | 34 | ||||
| -rw-r--r-- | third_party/lcms2-2.6/README.pdfium | 1 | ||||
| -rw-r--r-- | third_party/lcms2-2.6/src/cmsnamed.c | 16 |
3 files changed, 47 insertions, 4 deletions
diff --git a/third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch b/third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch new file mode 100644 index 0000000000..9c01a51579 --- /dev/null +++ b/third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch @@ -0,0 +1,34 @@ +diff --git a/third_party/lcms2-2.6/src/cmsnamed.c b/third_party/lcms2-2.6/src/cmsnamed.c +index acfd1c8..ef1eb30 100644 +--- a/third_party/lcms2-2.6/src/cmsnamed.c ++++ b/third_party/lcms2-2.6/src/cmsnamed.c +@@ -514,8 +514,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsAllocNamedColorList(cmsContext ContextID, cmsUIn + v ->nColors = 0; + v ->ContextID = ContextID; + +- while (v -> Allocated < n) +- GrowNamedColorList(v); ++ while (v -> Allocated < n) { ++ if (!GrowNamedColorList(v)) { ++ cmsFreeNamedColorList(v); ++ return NULL; ++ } ++ } + + strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix)-1); + strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix)-1); +@@ -544,8 +548,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsDupNamedColorList(const cmsNAMEDCOLORLIST* v) + if (NewNC == NULL) return NULL; + + // For really large tables we need this +- while (NewNC ->Allocated < v ->Allocated) +- GrowNamedColorList(NewNC); ++ while (NewNC ->Allocated < v ->Allocated) { ++ if (!GrowNamedColorList(NewNC)) { ++ cmsFreeNamedColorList(NewNC); ++ return NULL; ++ } ++ } + + memmove(NewNC ->Prefix, v ->Prefix, sizeof(v ->Prefix)); + memmove(NewNC ->Suffix, v ->Suffix, sizeof(v ->Suffix)); diff --git a/third_party/lcms2-2.6/README.pdfium b/third_party/lcms2-2.6/README.pdfium index 6c3d5dd4ef..c15b2b1221 100644 --- a/third_party/lcms2-2.6/README.pdfium +++ b/third_party/lcms2-2.6/README.pdfium @@ -11,4 +11,5 @@ Local Modifications: 0000-tag-type-confusion.patch: Fix a type confusion. 0001-from16-to-8-overflow.patch: Prevent a UBSan warning. +0002-infinite-loop-GrowNamedColorList.patch: Fix infinite loop when calling GrowNamedColorList. TODO(ochang): List other patches. diff --git a/third_party/lcms2-2.6/src/cmsnamed.c b/third_party/lcms2-2.6/src/cmsnamed.c index acfd1c8cf9..ef1eb3089e 100644 --- a/third_party/lcms2-2.6/src/cmsnamed.c +++ b/third_party/lcms2-2.6/src/cmsnamed.c @@ -514,8 +514,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsAllocNamedColorList(cmsContext ContextID, cmsUIn v ->nColors = 0; v ->ContextID = ContextID; - while (v -> Allocated < n) - GrowNamedColorList(v); + while (v -> Allocated < n) { + if (!GrowNamedColorList(v)) { + cmsFreeNamedColorList(v); + return NULL; + } + } strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix)-1); strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix)-1); @@ -544,8 +548,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsDupNamedColorList(const cmsNAMEDCOLORLIST* v) if (NewNC == NULL) return NULL; // For really large tables we need this - while (NewNC ->Allocated < v ->Allocated) - GrowNamedColorList(NewNC); + while (NewNC ->Allocated < v ->Allocated) { + if (!GrowNamedColorList(NewNC)) { + cmsFreeNamedColorList(NewNC); + return NULL; + } + } memmove(NewNC ->Prefix, v ->Prefix, sizeof(v ->Prefix)); memmove(NewNC ->Suffix, v ->Suffix, sizeof(v ->Suffix)); |