summaryrefslogtreecommitdiff
path: root/third_party
diff options
context:
space:
mode:
Diffstat (limited to 'third_party')
-rw-r--r--third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch34
-rw-r--r--third_party/lcms2-2.6/README.pdfium1
-rw-r--r--third_party/lcms2-2.6/src/cmsnamed.c16
3 files changed, 47 insertions, 4 deletions
diff --git a/third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch b/third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch
new file mode 100644
index 0000000000..9c01a51579
--- /dev/null
+++ b/third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch
@@ -0,0 +1,34 @@
+diff --git a/third_party/lcms2-2.6/src/cmsnamed.c b/third_party/lcms2-2.6/src/cmsnamed.c
+index acfd1c8..ef1eb30 100644
+--- a/third_party/lcms2-2.6/src/cmsnamed.c
++++ b/third_party/lcms2-2.6/src/cmsnamed.c
+@@ -514,8 +514,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsAllocNamedColorList(cmsContext ContextID, cmsUIn
+ v ->nColors = 0;
+ v ->ContextID = ContextID;
+
+- while (v -> Allocated < n)
+- GrowNamedColorList(v);
++ while (v -> Allocated < n) {
++ if (!GrowNamedColorList(v)) {
++ cmsFreeNamedColorList(v);
++ return NULL;
++ }
++ }
+
+ strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix)-1);
+ strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix)-1);
+@@ -544,8 +548,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsDupNamedColorList(const cmsNAMEDCOLORLIST* v)
+ if (NewNC == NULL) return NULL;
+
+ // For really large tables we need this
+- while (NewNC ->Allocated < v ->Allocated)
+- GrowNamedColorList(NewNC);
++ while (NewNC ->Allocated < v ->Allocated) {
++ if (!GrowNamedColorList(NewNC)) {
++ cmsFreeNamedColorList(NewNC);
++ return NULL;
++ }
++ }
+
+ memmove(NewNC ->Prefix, v ->Prefix, sizeof(v ->Prefix));
+ memmove(NewNC ->Suffix, v ->Suffix, sizeof(v ->Suffix));
diff --git a/third_party/lcms2-2.6/README.pdfium b/third_party/lcms2-2.6/README.pdfium
index 6c3d5dd4ef..c15b2b1221 100644
--- a/third_party/lcms2-2.6/README.pdfium
+++ b/third_party/lcms2-2.6/README.pdfium
@@ -11,4 +11,5 @@ Local Modifications:
0000-tag-type-confusion.patch: Fix a type confusion.
0001-from16-to-8-overflow.patch: Prevent a UBSan warning.
+0002-infinite-loop-GrowNamedColorList.patch: Fix infinite loop when calling GrowNamedColorList.
TODO(ochang): List other patches.
diff --git a/third_party/lcms2-2.6/src/cmsnamed.c b/third_party/lcms2-2.6/src/cmsnamed.c
index acfd1c8cf9..ef1eb3089e 100644
--- a/third_party/lcms2-2.6/src/cmsnamed.c
+++ b/third_party/lcms2-2.6/src/cmsnamed.c
@@ -514,8 +514,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsAllocNamedColorList(cmsContext ContextID, cmsUIn
v ->nColors = 0;
v ->ContextID = ContextID;
- while (v -> Allocated < n)
- GrowNamedColorList(v);
+ while (v -> Allocated < n) {
+ if (!GrowNamedColorList(v)) {
+ cmsFreeNamedColorList(v);
+ return NULL;
+ }
+ }
strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix)-1);
strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix)-1);
@@ -544,8 +548,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsDupNamedColorList(const cmsNAMEDCOLORLIST* v)
if (NewNC == NULL) return NULL;
// For really large tables we need this
- while (NewNC ->Allocated < v ->Allocated)
- GrowNamedColorList(NewNC);
+ while (NewNC ->Allocated < v ->Allocated) {
+ if (!GrowNamedColorList(NewNC)) {
+ cmsFreeNamedColorList(NewNC);
+ return NULL;
+ }
+ }
memmove(NewNC ->Prefix, v ->Prefix, sizeof(v ->Prefix));
memmove(NewNC ->Suffix, v ->Suffix, sizeof(v ->Suffix));