summaryrefslogtreecommitdiff
path: root/third_party
diff options
context:
space:
mode:
authorkcwu <kcwu@chromium.org>2016-09-22 12:56:23 -0700
committerCommit bot <commit-bot@chromium.org>2016-09-22 12:56:23 -0700
commit62356867b331bc9f71f9a0c8fce0cff9927d3356 (patch)
tree0b4ef2bdb6432efab31c61241a9553c320faee99 /third_party
parent869a4381b12dadfabe9750bd4d1a3867241917c8 (diff)
downloadpdfium-62356867b331bc9f71f9a0c8fce0cff9927d3356.tar.xz
Fix use uninitialized value and stack buffer overflow read
Found by libfuzzer Review-Url: https://codereview.chromium.org/2362813002
Diffstat (limited to 'third_party')
-rw-r--r--third_party/lcms2-2.6/0003-uninit.patch30
-rw-r--r--third_party/lcms2-2.6/README.pdfium1
-rw-r--r--third_party/lcms2-2.6/src/cmstypes.c5
3 files changed, 34 insertions, 2 deletions
diff --git a/third_party/lcms2-2.6/0003-uninit.patch b/third_party/lcms2-2.6/0003-uninit.patch
new file mode 100644
index 0000000000..476007e776
--- /dev/null
+++ b/third_party/lcms2-2.6/0003-uninit.patch
@@ -0,0 +1,30 @@
+diff --git a/third_party/lcms2-2.6/src/cmstypes.c b/third_party/lcms2-2.6/src/cmstypes.c
+index 06742b5..44c5b87 100644
+--- a/third_party/lcms2-2.6/src/cmstypes.c
++++ b/third_party/lcms2-2.6/src/cmstypes.c
+@@ -2964,7 +2964,7 @@ void *Type_ColorantTable_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER
+ {
+ cmsUInt32Number i, Count;
+ cmsNAMEDCOLORLIST* List;
+- char Name[34];
++ char Name[33];
+ cmsUInt16Number PCS[3];
+
+
+@@ -2979,7 +2979,7 @@ void *Type_ColorantTable_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER
+ for (i=0; i < Count; i++) {
+
+ if (io ->Read(io, Name, 32, 1) != 1) goto Error;
+- Name[33] = 0;
++ Name[32] = 0;
+
+ if (!_cmsReadUInt16Array(io, 3, PCS)) goto Error;
+
+@@ -3106,6 +3106,7 @@ void *Type_NamedColor_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* i
+
+ memset(Colorant, 0, sizeof(Colorant));
+ if (io -> Read(io, Root, 32, 1) != 1) return NULL;
++ Root[32] = 0;
+ if (!_cmsReadUInt16Array(io, 3, PCS)) goto Error;
+ if (!_cmsReadUInt16Array(io, nDeviceCoords, Colorant)) goto Error;
+
diff --git a/third_party/lcms2-2.6/README.pdfium b/third_party/lcms2-2.6/README.pdfium
index c15b2b1221..82bdbc60d3 100644
--- a/third_party/lcms2-2.6/README.pdfium
+++ b/third_party/lcms2-2.6/README.pdfium
@@ -12,4 +12,5 @@ Local Modifications:
0000-tag-type-confusion.patch: Fix a type confusion.
0001-from16-to-8-overflow.patch: Prevent a UBSan warning.
0002-infinite-loop-GrowNamedColorList.patch: Fix infinite loop when calling GrowNamedColorList.
+0003-uninit.patch: Fix use uninitialized value and stack buffer overflow read.
TODO(ochang): List other patches.
diff --git a/third_party/lcms2-2.6/src/cmstypes.c b/third_party/lcms2-2.6/src/cmstypes.c
index 06742b5ad6..44c5b87735 100644
--- a/third_party/lcms2-2.6/src/cmstypes.c
+++ b/third_party/lcms2-2.6/src/cmstypes.c
@@ -2964,7 +2964,7 @@ void *Type_ColorantTable_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER
{
cmsUInt32Number i, Count;
cmsNAMEDCOLORLIST* List;
- char Name[34];
+ char Name[33];
cmsUInt16Number PCS[3];
@@ -2979,7 +2979,7 @@ void *Type_ColorantTable_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER
for (i=0; i < Count; i++) {
if (io ->Read(io, Name, 32, 1) != 1) goto Error;
- Name[33] = 0;
+ Name[32] = 0;
if (!_cmsReadUInt16Array(io, 3, PCS)) goto Error;
@@ -3106,6 +3106,7 @@ void *Type_NamedColor_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* i
memset(Colorant, 0, sizeof(Colorant));
if (io -> Read(io, Root, 32, 1) != 1) return NULL;
+ Root[32] = 0;
if (!_cmsReadUInt16Array(io, 3, PCS)) goto Error;
if (!_cmsReadUInt16Array(io, nDeviceCoords, Colorant)) goto Error;