From 85fcf94eeae589641213c4301bbb16b44b10a282 Mon Sep 17 00:00:00 2001 From: kcwu Date: Mon, 17 Oct 2016 06:13:11 -0700 Subject: lcms: reject NaN when reading float numbers LerpFloat functions expect input values are normal float. They first clamp values to the range of [0.0, 1.0] and then calculate interpolation with the input values. If the input value is NaN, it will lead to heap buffer overflow because the index to LutTable is calculated based on the said value and fclamp(NaN) is not in expected [0.0, 1.0] range. This patch rejects all NaN values earlier when reading float numbers. So it also changed behavior for cases other than LerpFloat. I think it is okay because NaN doesn't make sense for usual calculations. BUG=654676 Review-Url: https://codereview.chromium.org/2422553002 --- third_party/lcms2-2.6/README.pdfium | 1 + 1 file changed, 1 insertion(+) (limited to 'third_party/lcms2-2.6/README.pdfium') diff --git a/third_party/lcms2-2.6/README.pdfium b/third_party/lcms2-2.6/README.pdfium index 1fa3f56164..5a9497dbf8 100644 --- a/third_party/lcms2-2.6/README.pdfium +++ b/third_party/lcms2-2.6/README.pdfium @@ -19,4 +19,5 @@ Local Modifications: 0007-memory-leak-OptimizeByResampling.patch: Fix memory leak in OptimizeByResampling. 0008-memory-leak-Type_MPEmatrix_Read.patch: Fix memory leak in MPEmatrix_Read. 0009-cols-rows-swap.patch: Fix rows/cols swap in cmsStageAllocMatrix. +0010-reject-nan.patch: Reject NaN when reading float numbers. TODO(ochang): List other patches. -- cgit v1.2.3