Fix infinite loop when calling GrowNamedColorList

Handle the case that GrowNamedColorList return fail when list is too
long. Otherwise the loop never ends.

Found by libfuzzer

Review-Url: https://codereview.chromium.org/2365663002

1 files changed, 34 insertions, 0 deletions

diff --git a/third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch b/third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch
new file mode 100644
index 0000000000..9c01a51579
--- /dev/null
+++ b/third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch
@@ -0,0 +1,34 @@
+diff --git a/third_party/lcms2-2.6/src/cmsnamed.c b/third_party/lcms2-2.6/src/cmsnamed.c
+index acfd1c8..ef1eb30 100644
+--- a/third_party/lcms2-2.6/src/cmsnamed.c
++++ b/third_party/lcms2-2.6/src/cmsnamed.c
+@@ -514,8 +514,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsAllocNamedColorList(cmsContext ContextID, cmsUIn
+     v ->nColors   = 0;
+     v ->ContextID  = ContextID;
+ 
+-    while (v -> Allocated < n)
+-        GrowNamedColorList(v);
++    while (v -> Allocated < n) {
++        if (!GrowNamedColorList(v)) {
++            cmsFreeNamedColorList(v);
++            return NULL;
++        }
++    }
+ 
+     strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix)-1);
+     strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix)-1);
+@@ -544,8 +548,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsDupNamedColorList(const cmsNAMEDCOLORLIST* v)
+     if (NewNC == NULL) return NULL;
+ 
+     // For really large tables we need this
+-    while (NewNC ->Allocated < v ->Allocated)
+-        GrowNamedColorList(NewNC);
++    while (NewNC ->Allocated < v ->Allocated) {
++        if (!GrowNamedColorList(NewNC)) {
++            cmsFreeNamedColorList(NewNC);
++            return NULL;
++        }
++    }
+ 
+     memmove(NewNC ->Prefix, v ->Prefix, sizeof(v ->Prefix));
+     memmove(NewNC ->Suffix, v ->Suffix, sizeof(v ->Suffix));