diff options
| author | kcwu <kcwu@chromium.org> | 2016-11-07 10:41:52 -0800 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2016-11-07 10:41:52 -0800 |
| commit | 413e3518ce390860cb5560720e5fba3ca7c8f764 (patch) | |
| tree | ab0fba43e66f7b5bb174eb93b959e9c54d20fbb0 /third_party/lcms2-2.6/src | |
| parent | eb3f68cc7f25a1e28464eb251161b8f08fcd04bc (diff) | |
| download | pdfium-413e3518ce390860cb5560720e5fba3ca7c8f764.tar.xz | |
lcms: backport upstream commit c0a98d86
This fixed several issues.
BUG=chromium:654265,chromium:657282,chromium:654676,chromium:654313
Review-Url: https://codereview.chromium.org/2482523003
Diffstat (limited to 'third_party/lcms2-2.6/src')
| -rw-r--r-- | third_party/lcms2-2.6/src/cmsintrp.c | 2 | ||||
| -rw-r--r-- | third_party/lcms2-2.6/src/cmsio0.c | 11 | ||||
| -rw-r--r-- | third_party/lcms2-2.6/src/cmstypes.c | 6 |
3 files changed, 17 insertions, 2 deletions
diff --git a/third_party/lcms2-2.6/src/cmsintrp.c b/third_party/lcms2-2.6/src/cmsintrp.c index 5d5f35d3fc..14c68563ca 100644 --- a/third_party/lcms2-2.6/src/cmsintrp.c +++ b/third_party/lcms2-2.6/src/cmsintrp.c @@ -215,7 +215,7 @@ void LinLerp1D(register const cmsUInt16Number Value[], // To prevent out of bounds indexing cmsINLINE cmsFloat32Number fclamp(cmsFloat32Number v) { - return v < 0.0f ? 0.0f : (v > 1.0f ? 1.0f : v); + return ((v < 0.0f) || isnan(v)) ? 0.0f : (v > 1.0f ? 1.0f : v); } // Floating-point version of 1D interpolation diff --git a/third_party/lcms2-2.6/src/cmsio0.c b/third_party/lcms2-2.6/src/cmsio0.c index 5f9f08a6f8..3ed730a92a 100644 --- a/third_party/lcms2-2.6/src/cmsio0.c +++ b/third_party/lcms2-2.6/src/cmsio0.c @@ -1475,6 +1475,17 @@ void* CMSEXPORT cmsReadTag(cmsHPROFILE hProfile, cmsTagSignature sig) // If the element is already in memory, return the pointer if (Icc -> TagPtrs[n]) { + if (Icc->TagTypeHandlers[n] == NULL) goto Error; + + // Sanity check + BaseType = Icc->TagTypeHandlers[n]->Signature; + if (BaseType == 0) goto Error; + + TagDescriptor = _cmsGetTagDescriptor(Icc->ContextID, sig); + if (TagDescriptor == NULL) goto Error; + + if (!IsTypeSupported(TagDescriptor, BaseType)) goto Error; + if (Icc ->TagSaveAsRaw[n]) goto Error; // We don't support read raw tags as cooked _cmsUnlockMutex(Icc->ContextID, Icc ->UsrMutex); diff --git a/third_party/lcms2-2.6/src/cmstypes.c b/third_party/lcms2-2.6/src/cmstypes.c index 04dd0c4e00..386439ba2b 100644 --- a/third_party/lcms2-2.6/src/cmstypes.c +++ b/third_party/lcms2-2.6/src/cmstypes.c @@ -4297,8 +4297,12 @@ void *Type_MPEclut_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* io, // Copy MAX_INPUT_DIMENSIONS at most. Expand to cmsUInt32Number nMaxGrids = InputChans > MAX_INPUT_DIMENSIONS ? MAX_INPUT_DIMENSIONS : InputChans; - for (i=0; i < nMaxGrids; i++) GridPoints[i] = (cmsUInt32Number) Dimensions8[i]; + for (i = 0; i < nMaxGrids; i++) { + if (Dimensions8[i] == 1) goto Error; // Impossible value, 0 for no CLUT and then 2 at least + GridPoints[i] = (cmsUInt32Number)Dimensions8[i]; + } + // Allocate the true CLUT mpe = cmsStageAllocCLutFloatGranular(self ->ContextID, GridPoints, InputChans, OutputChans, NULL); if (mpe == NULL) goto Error; |