Fix infinite loop when calling GrowNamedColorList

Handle the case that GrowNamedColorList return fail when list is too
long. Otherwise the loop never ends.

Found by libfuzzer

Review-Url: https://codereview.chromium.org/2365663002

1 files changed, 12 insertions, 4 deletions

diff --git a/third_party/lcms2-2.6/src/cmsnamed.c b/third_party/lcms2-2.6/src/cmsnamed.c
index acfd1c8cf9..ef1eb3089e 100644
--- a/third_party/lcms2-2.6/src/cmsnamed.c
+++ b/third_party/lcms2-2.6/src/cmsnamed.c
@@ -514,8 +514,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsAllocNamedColorList(cmsContext ContextID, cmsUIn
     v ->nColors   = 0;
     v ->ContextID  = ContextID;
 
-    while (v -> Allocated < n)
-        GrowNamedColorList(v);
+    while (v -> Allocated < n) {
+        if (!GrowNamedColorList(v)) {
+            cmsFreeNamedColorList(v);
+            return NULL;
+        }
+    }
 
     strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix)-1);
     strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix)-1);
@@ -544,8 +548,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsDupNamedColorList(const cmsNAMEDCOLORLIST* v)
     if (NewNC == NULL) return NULL;
 
     // For really large tables we need this
-    while (NewNC ->Allocated < v ->Allocated)
-        GrowNamedColorList(NewNC);
+    while (NewNC ->Allocated < v ->Allocated) {
+        if (!GrowNamedColorList(NewNC)) {
+            cmsFreeNamedColorList(NewNC);
+            return NULL;
+        }
+    }
 
     memmove(NewNC ->Prefix, v ->Prefix, sizeof(v ->Prefix));
     memmove(NewNC ->Suffix, v ->Suffix, sizeof(v ->Suffix));