5 files changed, 25 insertions, 31 deletions
diff --git a/third_party/lcms2-2.6/0009-cmdStageAllocMatrix-param-swap.patch b/third_party/lcms2-2.6/0009-cmdStageAllocMatrix-param-swap.patch
deleted file mode 100644
index 59ffbd423f..0000000000
--- a/third_party/lcms2-2.6/0009-cmdStageAllocMatrix-param-swap.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-diff --git a/third_party/lcms2-2.6/src/cmslut.c b/third_party/lcms2-2.6/src/cmslut.c
-index 73e6726..8d5aa60 100644
---- a/third_party/lcms2-2.6/src/cmslut.c
-+++ b/third_party/lcms2-2.6/src/cmslut.c
-@@ -391,7 +391,7 @@ cmsStage*  CMSEXPORT cmsStageAllocMatrix(cmsContext ContextID, cmsUInt32Number R
-     if (n >= UINT_MAX / Rows) return NULL;
-     if (n < Rows || n < Cols) return NULL;
- 
--    NewMPE = _cmsStageAllocPlaceholder(ContextID, cmsSigMatrixElemType, Cols, Rows,
-+    NewMPE = _cmsStageAllocPlaceholder(ContextID, cmsSigMatrixElemType, Rows, Cols,
-                                      EvaluateMatrix, MatrixElemDup, MatrixElemTypeFree, NULL );
-     if (NewMPE == NULL) return NULL;
- 
-diff --git a/third_party/lcms2-2.6/src/cmstypes.c b/third_party/lcms2-2.6/src/cmstypes.c
-index 15199c7..6f335d9 100644
---- a/third_party/lcms2-2.6/src/cmstypes.c
-+++ b/third_party/lcms2-2.6/src/cmstypes.c
-@@ -4225,7 +4225,7 @@ void *Type_MPEmatrix_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* io
-     }
- 
- 
--    mpe = cmsStageAllocMatrix(self ->ContextID, OutputChans, InputChans, Matrix, Offsets);
-+    mpe = cmsStageAllocMatrix(self ->ContextID, InputChans, OutputChans, Matrix, Offsets);
-     _cmsFree(self ->ContextID, Matrix);
-     _cmsFree(self ->ContextID, Offsets);
- 
diff --git a/third_party/lcms2-2.6/0009-cmsStageAllocMatrix-param-swap.patch b/third_party/lcms2-2.6/0009-cmsStageAllocMatrix-param-swap.patch
new file mode 100644
index 0000000000..26db3dd223
--- /dev/null
+++ b/third_party/lcms2-2.6/0009-cmsStageAllocMatrix-param-swap.patch
@@ -0,0 +1,20 @@
+diff --git a/third_party/lcms2-2.6/src/cmslut.c b/third_party/lcms2-2.6/src/cmslut.c
+index 73e6726..9b0eb4b 100644
+--- a/third_party/lcms2-2.6/src/cmslut.c
++++ b/third_party/lcms2-2.6/src/cmslut.c
+@@ -414,13 +414,13 @@ cmsStage*  CMSEXPORT cmsStageAllocMatrix(cmsContext ContextID, cmsUInt32Number R
+ 
+     if (Offset != NULL) {
+ 
+-        NewElem ->Offset = (cmsFloat64Number*) _cmsCalloc(ContextID, Cols, sizeof(cmsFloat64Number));
++        NewElem ->Offset = (cmsFloat64Number*) _cmsCalloc(ContextID, Rows, sizeof(cmsFloat64Number));
+         if (NewElem->Offset == NULL) {
+            MatrixElemTypeFree(NewMPE);
+            return NULL;
+         }
+ 
+-        for (i=0; i < Cols; i++) {
++        for (i=0; i < Rows; i++) {
+                 NewElem ->Offset[i] = Offset[i];
+         }
+ 
diff --git a/third_party/lcms2-2.6/README.pdfium b/third_party/lcms2-2.6/README.pdfium
index 5a9497dbf8..60934f61b1 100644
--- a/third_party/lcms2-2.6/README.pdfium
+++ b/third_party/lcms2-2.6/README.pdfium
@@ -18,6 +18,6 @@ Local Modifications:
 0006-memory-leak-Type_NamedColor_Read.patch: Fix memory leak in Type_NamedColor_Read.
 0007-memory-leak-OptimizeByResampling.patch: Fix memory leak in OptimizeByResampling.
 0008-memory-leak-Type_MPEmatrix_Read.patch: Fix memory leak in MPEmatrix_Read.
-0009-cols-rows-swap.patch: Fix rows/cols swap in cmsStageAllocMatrix.
+0009-cmsStageAllocMatrix-param-swap.patch: Fix rows/cols swap in cmsStageAllocMatrix.
 0010-reject-nan.patch: Reject NaN when reading float numbers.
 TODO(ochang): List other patches.
diff --git a/third_party/lcms2-2.6/src/cmslut.c b/third_party/lcms2-2.6/src/cmslut.c
index 8d5aa60bfb..9b0eb4b549 100644
--- a/third_party/lcms2-2.6/src/cmslut.c
+++ b/third_party/lcms2-2.6/src/cmslut.c
@@ -391,7 +391,7 @@ cmsStage*  CMSEXPORT cmsStageAllocMatrix(cmsContext ContextID, cmsUInt32Number R
     if (n >= UINT_MAX / Rows) return NULL;
     if (n < Rows || n < Cols) return NULL;
 
-    NewMPE = _cmsStageAllocPlaceholder(ContextID, cmsSigMatrixElemType, Rows, Cols,
+    NewMPE = _cmsStageAllocPlaceholder(ContextID, cmsSigMatrixElemType, Cols, Rows,
                                      EvaluateMatrix, MatrixElemDup, MatrixElemTypeFree, NULL );
     if (NewMPE == NULL) return NULL;
 
@@ -414,13 +414,13 @@ cmsStage*  CMSEXPORT cmsStageAllocMatrix(cmsContext ContextID, cmsUInt32Number R
 
     if (Offset != NULL) {
 
-        NewElem ->Offset = (cmsFloat64Number*) _cmsCalloc(ContextID, Cols, sizeof(cmsFloat64Number));
+        NewElem ->Offset = (cmsFloat64Number*) _cmsCalloc(ContextID, Rows, sizeof(cmsFloat64Number));
         if (NewElem->Offset == NULL) {
            MatrixElemTypeFree(NewMPE);
            return NULL;
         }
 
-        for (i=0; i < Cols; i++) {
+        for (i=0; i < Rows; i++) {
                 NewElem ->Offset[i] = Offset[i];
         }
 
diff --git a/third_party/lcms2-2.6/src/cmstypes.c b/third_party/lcms2-2.6/src/cmstypes.c
index 6f335d9bb1..15199c7084 100644
--- a/third_party/lcms2-2.6/src/cmstypes.c
+++ b/third_party/lcms2-2.6/src/cmstypes.c
@@ -4225,7 +4225,7 @@ void *Type_MPEmatrix_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* io
     }
 
 
-    mpe = cmsStageAllocMatrix(self ->ContextID, InputChans, OutputChans, Matrix, Offsets);
+    mpe = cmsStageAllocMatrix(self ->ContextID, OutputChans, InputChans, Matrix, Offsets);
     _cmsFree(self ->ContextID, Matrix);
     _cmsFree(self ->ContextID, Offsets);