From 869a4381b12dadfabe9750bd4d1a3867241917c8 Mon Sep 17 00:00:00 2001
From: kcwu <kcwu@chromium.org>
Date: Thu, 22 Sep 2016 11:45:50 -0700
Subject: Fix infinite loop when calling GrowNamedColorList

Handle the case that GrowNamedColorList return fail when list is too
long. Otherwise the loop never ends.

Found by libfuzzer

Review-Url: https://codereview.chromium.org/2365663002
---
 .../0002-infinite-loop-GrowNamedColorList.patch    | 34 ++++++++++++++++++++++
 third_party/lcms2-2.6/README.pdfium                |  1 +
 third_party/lcms2-2.6/src/cmsnamed.c               | 16 +++++++---
 3 files changed, 47 insertions(+), 4 deletions(-)
 create mode 100644 third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch

diff --git a/third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch b/third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch
new file mode 100644
index 0000000000..9c01a51579
--- /dev/null
+++ b/third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch
@@ -0,0 +1,34 @@
+diff --git a/third_party/lcms2-2.6/src/cmsnamed.c b/third_party/lcms2-2.6/src/cmsnamed.c
+index acfd1c8..ef1eb30 100644
+--- a/third_party/lcms2-2.6/src/cmsnamed.c
++++ b/third_party/lcms2-2.6/src/cmsnamed.c
+@@ -514,8 +514,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsAllocNamedColorList(cmsContext ContextID, cmsUIn
+     v ->nColors   = 0;
+     v ->ContextID  = ContextID;
+ 
+-    while (v -> Allocated < n)
+-        GrowNamedColorList(v);
++    while (v -> Allocated < n) {
++        if (!GrowNamedColorList(v)) {
++            cmsFreeNamedColorList(v);
++            return NULL;
++        }
++    }
+ 
+     strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix)-1);
+     strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix)-1);
+@@ -544,8 +548,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsDupNamedColorList(const cmsNAMEDCOLORLIST* v)
+     if (NewNC == NULL) return NULL;
+ 
+     // For really large tables we need this
+-    while (NewNC ->Allocated < v ->Allocated)
+-        GrowNamedColorList(NewNC);
++    while (NewNC ->Allocated < v ->Allocated) {
++        if (!GrowNamedColorList(NewNC)) {
++            cmsFreeNamedColorList(NewNC);
++            return NULL;
++        }
++    }
+ 
+     memmove(NewNC ->Prefix, v ->Prefix, sizeof(v ->Prefix));
+     memmove(NewNC ->Suffix, v ->Suffix, sizeof(v ->Suffix));
diff --git a/third_party/lcms2-2.6/README.pdfium b/third_party/lcms2-2.6/README.pdfium
index 6c3d5dd4ef..c15b2b1221 100644
--- a/third_party/lcms2-2.6/README.pdfium
+++ b/third_party/lcms2-2.6/README.pdfium
@@ -11,4 +11,5 @@ Local Modifications:
 
 0000-tag-type-confusion.patch: Fix a type confusion.
 0001-from16-to-8-overflow.patch: Prevent a UBSan warning.
+0002-infinite-loop-GrowNamedColorList.patch: Fix infinite loop when calling GrowNamedColorList.
 TODO(ochang): List other patches.
diff --git a/third_party/lcms2-2.6/src/cmsnamed.c b/third_party/lcms2-2.6/src/cmsnamed.c
index acfd1c8cf9..ef1eb3089e 100644
--- a/third_party/lcms2-2.6/src/cmsnamed.c
+++ b/third_party/lcms2-2.6/src/cmsnamed.c
@@ -514,8 +514,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsAllocNamedColorList(cmsContext ContextID, cmsUIn
     v ->nColors   = 0;
     v ->ContextID  = ContextID;
 
-    while (v -> Allocated < n)
-        GrowNamedColorList(v);
+    while (v -> Allocated < n) {
+        if (!GrowNamedColorList(v)) {
+            cmsFreeNamedColorList(v);
+            return NULL;
+        }
+    }
 
     strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix)-1);
     strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix)-1);
@@ -544,8 +548,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsDupNamedColorList(const cmsNAMEDCOLORLIST* v)
     if (NewNC == NULL) return NULL;
 
     // For really large tables we need this
-    while (NewNC ->Allocated < v ->Allocated)
-        GrowNamedColorList(NewNC);
+    while (NewNC ->Allocated < v ->Allocated) {
+        if (!GrowNamedColorList(NewNC)) {
+            cmsFreeNamedColorList(NewNC);
+            return NULL;
+        }
+    }
 
     memmove(NewNC ->Prefix, v ->Prefix, sizeof(v ->Prefix));
     memmove(NewNC ->Suffix, v ->Suffix, sizeof(v ->Suffix));
-- 
cgit v1.2.3