diff options
author | kcwu <kcwu@chromium.org> | 2016-09-22 11:45:50 -0700 |
---|---|---|
committer | Commit bot <commit-bot@chromium.org> | 2016-09-22 11:45:50 -0700 |
commit | 869a4381b12dadfabe9750bd4d1a3867241917c8 (patch) | |
tree | 4570d85e433337653766287d8b96f8e3e5c33f9b /third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch | |
parent | fef62e1f2bbf064100e6e262a10653f2374bfd2b (diff) | |
download | pdfium-869a4381b12dadfabe9750bd4d1a3867241917c8.tar.xz |
Fix infinite loop when calling GrowNamedColorList
Handle the case that GrowNamedColorList return fail when list is too
long. Otherwise the loop never ends.
Found by libfuzzer
Review-Url: https://codereview.chromium.org/2365663002
Diffstat (limited to 'third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch')
-rw-r--r-- | third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch b/third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch new file mode 100644 index 0000000000..9c01a51579 --- /dev/null +++ b/third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch @@ -0,0 +1,34 @@ +diff --git a/third_party/lcms2-2.6/src/cmsnamed.c b/third_party/lcms2-2.6/src/cmsnamed.c +index acfd1c8..ef1eb30 100644 +--- a/third_party/lcms2-2.6/src/cmsnamed.c ++++ b/third_party/lcms2-2.6/src/cmsnamed.c +@@ -514,8 +514,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsAllocNamedColorList(cmsContext ContextID, cmsUIn + v ->nColors = 0; + v ->ContextID = ContextID; + +- while (v -> Allocated < n) +- GrowNamedColorList(v); ++ while (v -> Allocated < n) { ++ if (!GrowNamedColorList(v)) { ++ cmsFreeNamedColorList(v); ++ return NULL; ++ } ++ } + + strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix)-1); + strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix)-1); +@@ -544,8 +548,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsDupNamedColorList(const cmsNAMEDCOLORLIST* v) + if (NewNC == NULL) return NULL; + + // For really large tables we need this +- while (NewNC ->Allocated < v ->Allocated) +- GrowNamedColorList(NewNC); ++ while (NewNC ->Allocated < v ->Allocated) { ++ if (!GrowNamedColorList(NewNC)) { ++ cmsFreeNamedColorList(NewNC); ++ return NULL; ++ } ++ } + + memmove(NewNC ->Prefix, v ->Prefix, sizeof(v ->Prefix)); + memmove(NewNC ->Suffix, v ->Suffix, sizeof(v ->Suffix)); |