summaryrefslogtreecommitdiff
path: root/third_party/lcms2-2.6/src/cmsnamed.c
diff options
context:
space:
mode:
authorkcwu <kcwu@chromium.org>2016-09-22 11:45:50 -0700
committerCommit bot <commit-bot@chromium.org>2016-09-22 11:45:50 -0700
commit869a4381b12dadfabe9750bd4d1a3867241917c8 (patch)
tree4570d85e433337653766287d8b96f8e3e5c33f9b /third_party/lcms2-2.6/src/cmsnamed.c
parentfef62e1f2bbf064100e6e262a10653f2374bfd2b (diff)
downloadpdfium-869a4381b12dadfabe9750bd4d1a3867241917c8.tar.xz
Fix infinite loop when calling GrowNamedColorList
Handle the case that GrowNamedColorList return fail when list is too long. Otherwise the loop never ends. Found by libfuzzer Review-Url: https://codereview.chromium.org/2365663002
Diffstat (limited to 'third_party/lcms2-2.6/src/cmsnamed.c')
-rw-r--r--third_party/lcms2-2.6/src/cmsnamed.c16
1 files changed, 12 insertions, 4 deletions
diff --git a/third_party/lcms2-2.6/src/cmsnamed.c b/third_party/lcms2-2.6/src/cmsnamed.c
index acfd1c8cf9..ef1eb3089e 100644
--- a/third_party/lcms2-2.6/src/cmsnamed.c
+++ b/third_party/lcms2-2.6/src/cmsnamed.c
@@ -514,8 +514,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsAllocNamedColorList(cmsContext ContextID, cmsUIn
v ->nColors = 0;
v ->ContextID = ContextID;
- while (v -> Allocated < n)
- GrowNamedColorList(v);
+ while (v -> Allocated < n) {
+ if (!GrowNamedColorList(v)) {
+ cmsFreeNamedColorList(v);
+ return NULL;
+ }
+ }
strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix)-1);
strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix)-1);
@@ -544,8 +548,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsDupNamedColorList(const cmsNAMEDCOLORLIST* v)
if (NewNC == NULL) return NULL;
// For really large tables we need this
- while (NewNC ->Allocated < v ->Allocated)
- GrowNamedColorList(NewNC);
+ while (NewNC ->Allocated < v ->Allocated) {
+ if (!GrowNamedColorList(NewNC)) {
+ cmsFreeNamedColorList(NewNC);
+ return NULL;
+ }
+ }
memmove(NewNC ->Prefix, v ->Prefix, sizeof(v ->Prefix));
memmove(NewNC ->Suffix, v ->Suffix, sizeof(v ->Suffix));