summaryrefslogtreecommitdiff
path: root/third_party/lcms2-2.6
diff options
context:
space:
mode:
authorkcwu <kcwu@chromium.org>2016-09-22 11:45:50 -0700
committerCommit bot <commit-bot@chromium.org>2016-09-22 11:45:50 -0700
commit869a4381b12dadfabe9750bd4d1a3867241917c8 (patch)
tree4570d85e433337653766287d8b96f8e3e5c33f9b /third_party/lcms2-2.6
parentfef62e1f2bbf064100e6e262a10653f2374bfd2b (diff)
downloadpdfium-869a4381b12dadfabe9750bd4d1a3867241917c8.tar.xz
Fix infinite loop when calling GrowNamedColorList
Handle the case that GrowNamedColorList return fail when list is too long. Otherwise the loop never ends. Found by libfuzzer Review-Url: https://codereview.chromium.org/2365663002
Diffstat (limited to 'third_party/lcms2-2.6')
-rw-r--r--third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch34
-rw-r--r--third_party/lcms2-2.6/README.pdfium1
-rw-r--r--third_party/lcms2-2.6/src/cmsnamed.c16
3 files changed, 47 insertions, 4 deletions
diff --git a/third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch b/third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch
new file mode 100644
index 0000000000..9c01a51579
--- /dev/null
+++ b/third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch
@@ -0,0 +1,34 @@
+diff --git a/third_party/lcms2-2.6/src/cmsnamed.c b/third_party/lcms2-2.6/src/cmsnamed.c
+index acfd1c8..ef1eb30 100644
+--- a/third_party/lcms2-2.6/src/cmsnamed.c
++++ b/third_party/lcms2-2.6/src/cmsnamed.c
+@@ -514,8 +514,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsAllocNamedColorList(cmsContext ContextID, cmsUIn
+ v ->nColors = 0;
+ v ->ContextID = ContextID;
+
+- while (v -> Allocated < n)
+- GrowNamedColorList(v);
++ while (v -> Allocated < n) {
++ if (!GrowNamedColorList(v)) {
++ cmsFreeNamedColorList(v);
++ return NULL;
++ }
++ }
+
+ strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix)-1);
+ strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix)-1);
+@@ -544,8 +548,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsDupNamedColorList(const cmsNAMEDCOLORLIST* v)
+ if (NewNC == NULL) return NULL;
+
+ // For really large tables we need this
+- while (NewNC ->Allocated < v ->Allocated)
+- GrowNamedColorList(NewNC);
++ while (NewNC ->Allocated < v ->Allocated) {
++ if (!GrowNamedColorList(NewNC)) {
++ cmsFreeNamedColorList(NewNC);
++ return NULL;
++ }
++ }
+
+ memmove(NewNC ->Prefix, v ->Prefix, sizeof(v ->Prefix));
+ memmove(NewNC ->Suffix, v ->Suffix, sizeof(v ->Suffix));
diff --git a/third_party/lcms2-2.6/README.pdfium b/third_party/lcms2-2.6/README.pdfium
index 6c3d5dd4ef..c15b2b1221 100644
--- a/third_party/lcms2-2.6/README.pdfium
+++ b/third_party/lcms2-2.6/README.pdfium
@@ -11,4 +11,5 @@ Local Modifications:
0000-tag-type-confusion.patch: Fix a type confusion.
0001-from16-to-8-overflow.patch: Prevent a UBSan warning.
+0002-infinite-loop-GrowNamedColorList.patch: Fix infinite loop when calling GrowNamedColorList.
TODO(ochang): List other patches.
diff --git a/third_party/lcms2-2.6/src/cmsnamed.c b/third_party/lcms2-2.6/src/cmsnamed.c
index acfd1c8cf9..ef1eb3089e 100644
--- a/third_party/lcms2-2.6/src/cmsnamed.c
+++ b/third_party/lcms2-2.6/src/cmsnamed.c
@@ -514,8 +514,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsAllocNamedColorList(cmsContext ContextID, cmsUIn
v ->nColors = 0;
v ->ContextID = ContextID;
- while (v -> Allocated < n)
- GrowNamedColorList(v);
+ while (v -> Allocated < n) {
+ if (!GrowNamedColorList(v)) {
+ cmsFreeNamedColorList(v);
+ return NULL;
+ }
+ }
strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix)-1);
strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix)-1);
@@ -544,8 +548,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsDupNamedColorList(const cmsNAMEDCOLORLIST* v)
if (NewNC == NULL) return NULL;
// For really large tables we need this
- while (NewNC ->Allocated < v ->Allocated)
- GrowNamedColorList(NewNC);
+ while (NewNC ->Allocated < v ->Allocated) {
+ if (!GrowNamedColorList(NewNC)) {
+ cmsFreeNamedColorList(NewNC);
+ return NULL;
+ }
+ }
memmove(NewNC ->Prefix, v ->Prefix, sizeof(v ->Prefix));
memmove(NewNC ->Suffix, v ->Suffix, sizeof(v ->Suffix));