qcms: Limit vcgt table to a maximum of 1024 entries

third_party/qcms/google.patch

 diff --git a/third_party/qcms/src/iccread.c b/third_party/qcms/src/iccread.c
-index 36b7011..18b286d 100644
+index 36b7011..0deab10 100644
 --- a/third_party/qcms/src/iccread.c
 +++ b/third_party/qcms/src/iccread.c
 @@ -266,7 +266,7 @@ qcms_bool qcms_profile_is_bogus(qcms_profile *profile)
         if (profile->color_space != RGB_SIGNATURE)
                return false;
  
 -       if (profile->A2B0 || profile->B2A0)
 +       if (qcms_supports_iccv4 && (profile->A2B0 || profile->B2A0))
                 return false;
  
@@ skipping 23 matching lines @@
             if (!(((sum[i] - tolerance[i]) <= target[i]) &&
 @@ -331,6 +340,8 @@ qcms_bool qcms_profile_is_bogus(qcms_profile *profile)
  #define TAG_A2B0 0x41324230
  #define TAG_B2A0 0x42324130
  #define TAG_CHAD 0x63686164
 +#define TAG_desc 0x64657363
 +#define TAG_vcgt 0x76636774
  
  static struct tag *find_tag(struct tag_index index, uint32_t tag_id)
  {
-@@ -344,6 +355,211 @@ static struct tag *find_tag(struct tag_index index, uint32_t tag_id)
+@@ -344,6 +355,215 @@ static struct tag *find_tag(struct tag_index index, uint32_t tag_id)
         return tag;
  }
  
 +#define DESC_TYPE 0x64657363 // 'desc'
 +#define MLUC_TYPE 0x6d6c7563 // 'mluc'
 +#define MMOD_TYPE 0x6D6D6F64 // 'mmod'
 +#define VCGT_TYPE 0x76636774 // 'vcgt'
 +
 +// Check unsigned short is uint16_t.
 +typedef char assert_short_not_16b[(sizeof(unsigned short) == sizeof(uint16_t)) ? 1 : -1];
@@ skipping 14 matching lines @@
 +
 +       // Only support 3 channels.
 +       if (channels != 3)
 +               return true;
 +       // Only support single or double byte values.
 +       if (byte_depth != 1 && byte_depth != 2)
 +               return true;
 +       // Only support table data, not equation.
 +       if (vcgt_type != 0)
 +               return true;
++       // Limit the table to a sensible size; 10-bit gamma is a reasonable
++       // maximum for hardware correction.
++       if (elements > 1024)
++               return true;
 +
 +       // Empty table is invalid.
 +       if (!elements)
 +               goto invalid_vcgt_tag;
 +
 +       profile->vcgt.length = elements;
 +       profile->vcgt.data = malloc(3 * elements * sizeof(uint16_t));
 +       if (!profile->vcgt.data)
 +               return false;
 +
@@ skipping 157 matching lines @@
 +invalid_mmod_tag:
 +       invalid_source(src, "invalid mmod tag");
 +       return false;
 +}
 +
 +#endif // __APPLE__
 +
  #define XYZ_TYPE               0x58595a20 // 'XYZ '
  #define CURVE_TYPE             0x63757276 // 'curv'
  #define PARAMETRIC_CURVE_TYPE  0x70617261 // 'para'
-@@ -402,7 +618,7 @@ static struct XYZNumber read_tag_XYZType(struct mem_source *src, struct tag_inde
+@@ -402,7 +622,7 @@ static struct XYZNumber read_tag_XYZType(struct mem_source *src, struct tag_inde
  // present that are not part of the tag_index.
  static struct curveType *read_curveType(struct mem_source *src, uint32_t offset, uint32_t *len)
  {
 -       static const size_t COUNT_TO_LENGTH[5] = {1, 3, 4, 5, 7};
 +       static const uint32_t COUNT_TO_LENGTH[5] = {1, 3, 4, 5, 7};
         struct curveType *curve = NULL;
         uint32_t type = read_u32(src, offset);
         uint32_t count;
-@@ -484,19 +700,23 @@ static void read_nested_curveType(struct mem_source *src, struct curveType *(*cu
+@@ -484,19 +704,23 @@ static void read_nested_curveType(struct mem_source *src, struct curveType *(*cu
         uint32_t channel_offset = 0;
         int i;
         for (i = 0; i < num_channels; i++) {
 -               uint32_t tag_len;
 +               uint32_t tag_len = ~0;
  
                 (*curveArray)[i] = read_curveType(src, curve_offset + channel_offset, &tag_len);
                 if (!(*curveArray)[i]) {
                         invalid_source(src, "invalid nested curveType curve");
                 }
  
 +               if (tag_len == ~0) {
 +                       invalid_source(src, "invalid nested curveType tag length");
 +                       return;
 +               }
 +
                 channel_offset += tag_len;
                 // 4 byte aligned
                 if ((tag_len % 4) != 0)
                         channel_offset += 4 - (tag_len % 4);
         }
 -
  }
  
  static void mAB_release(struct lutmABType *lut)
-@@ -540,7 +760,7 @@ static struct lutmABType *read_tag_lutmABType(struct mem_source *src, struct tag
+@@ -540,7 +764,7 @@ static struct lutmABType *read_tag_lutmABType(struct mem_source *src, struct tag
         // We require 3in/out channels since we only support RGB->XYZ (or RGB->LAB)
         // XXX: If we remove this restriction make sure that the number of channels
         //      is less or equal to the maximum number of mAB curves in qcmsint.h
 -       //      also check for clut_size overflow.
 +       //      also check for clut_size overflow. Also make sure it's != 0
         if (num_in_channels != 3 || num_out_channels != 3)
                 return NULL;
  
-@@ -570,6 +790,9 @@ static struct lutmABType *read_tag_lutmABType(struct mem_source *src, struct tag
+@@ -570,6 +794,9 @@ static struct lutmABType *read_tag_lutmABType(struct mem_source *src, struct tag
                 // clut_size can not overflow since lg(256^num_in_channels) = 24 bits.
                 for (i = 0; i < num_in_channels; i++) {
                         clut_size *= read_u8(src, clut_offset + i);
 +                       if (clut_size == 0) {
 +                               invalid_source(src, "bad clut_size");
 +                       }
                 }
         } else {
                 clut_size = 0;
-@@ -590,6 +813,9 @@ static struct lutmABType *read_tag_lutmABType(struct mem_source *src, struct tag
+@@ -590,6 +817,9 @@ static struct lutmABType *read_tag_lutmABType(struct mem_source *src, struct tag
  
         for (i = 0; i < num_in_channels; i++) {
                 lut->num_grid_points[i] = read_u8(src, clut_offset + i);
 +               if (lut->num_grid_points[i] == 0) {
 +                       invalid_source(src, "bad grid_points");
 +               }
         }
  
         // Reverse the processing of transformation elements for mBA type.
-@@ -657,7 +883,7 @@ static struct lutType *read_tag_lutType(struct mem_source *src, struct tag_index
+@@ -657,7 +887,7 @@ static struct lutType *read_tag_lutType(struct mem_source *src, struct tag_index
         uint16_t num_input_table_entries;
         uint16_t num_output_table_entries;
         uint8_t in_chan, grid_points, out_chan;
 -       uint32_t clut_offset, output_offset;
 +       size_t clut_offset, output_offset;
         uint32_t clut_size;
         size_t entry_size;
         struct lutType *lut;
-@@ -672,6 +898,10 @@ static struct lutType *read_tag_lutType(struct mem_source *src, struct tag_index
+@@ -672,6 +902,10 @@ static struct lutType *read_tag_lutType(struct mem_source *src, struct tag_index
         } else if (type == LUT16_TYPE) {
                 num_input_table_entries  = read_u16(src, offset + 48);
                 num_output_table_entries = read_u16(src, offset + 50);
 +               if (num_input_table_entries == 0 || num_output_table_entries == 0) {
 +                       invalid_source(src, "Bad channel count");
 +                       return NULL;
 +               }
                 entry_size = 2;
         } else {
                 assert(0); // the caller checks that this doesn't happen
-@@ -685,15 +915,18 @@ static struct lutType *read_tag_lutType(struct mem_source *src, struct tag_index
+@@ -685,15 +919,18 @@ static struct lutType *read_tag_lutType(struct mem_source *src, struct tag_index
  
         clut_size = pow(grid_points, in_chan);
         if (clut_size > MAX_CLUT_SIZE) {
 +               invalid_source(src, "CLUT too large");
                 return NULL;
         }
  
         if (in_chan != 3 || out_chan != 3) {
 +               invalid_source(src, "CLUT only supports RGB");
                 return NULL;
         }
  
         lut = malloc(sizeof(struct lutType) + (num_input_table_entries * in_chan + clut_size*out_chan + num_output_table_entries * out_chan)*sizeof(float));
         if (!lut) {
 +               invalid_source(src, "CLUT too large");
                 return NULL;
         }
  
-@@ -704,9 +937,9 @@ static struct lutType *read_tag_lutType(struct mem_source *src, struct tag_index
+@@ -704,9 +941,9 @@ static struct lutType *read_tag_lutType(struct mem_source *src, struct tag_index
  
         lut->num_input_table_entries  = num_input_table_entries;
         lut->num_output_table_entries = num_output_table_entries;
 -       lut->num_input_channels   = read_u8(src, offset + 8);
 -       lut->num_output_channels  = read_u8(src, offset + 9);
 -       lut->num_clut_grid_points = read_u8(src, offset + 10);
 +       lut->num_input_channels   = in_chan;
 +       lut->num_output_channels  = out_chan;
 +       lut->num_clut_grid_points = grid_points;
         lut->e00 = read_s15Fixed16Number(src, offset+12);
         lut->e01 = read_s15Fixed16Number(src, offset+16);
         lut->e02 = read_s15Fixed16Number(src, offset+20);
-@@ -979,11 +1212,13 @@ qcms_profile* qcms_profile_sRGB(void)
+@@ -979,11 +1216,13 @@ qcms_profile* qcms_profile_sRGB(void)
                 return NO_MEM_PROFILE;
  
         profile = qcms_profile_create_rgb_with_table(D65, Rec709Primaries, table, 1024);
 +       if (profile)
 +               strcpy(profile->description, "sRGB IEC61966-2.1");
 +
         free(table);
         return profile;
  }
  
 -
  /* qcms_profile_from_memory does not hold a reference to the memory passed in */
  qcms_profile* qcms_profile_from_memory(const void *mem, size_t size)
  {
-@@ -997,6 +1232,9 @@ qcms_profile* qcms_profile_from_memory(const void *mem, size_t size)
+@@ -997,6 +1236,9 @@ qcms_profile* qcms_profile_from_memory(const void *mem, size_t size)
         source.size = size;
         source.valid = true;
  
 +       if (size < 4)
 +               return INVALID_PROFILE;
 +
         length = read_u32(src, 0);
         if (length <= size) {
                 // shrink the area that we can read if appropriate
-@@ -1028,12 +1266,26 @@ qcms_profile* qcms_profile_from_memory(const void *mem, size_t size)
+@@ -1028,12 +1270,26 @@ qcms_profile* qcms_profile_from_memory(const void *mem, size_t size)
         if (!src->valid || !index.tags)
                 goto invalid_tag_table;
  
 +       if (!read_tag_descType(profile, src, index, TAG_desc))
 +               goto invalid_tag_table;
 +#if defined(__APPLE__)
 +       if (!read_tag_dscmType(profile, src, index, TAG_dscm))
 +               goto invalid_tag_table;
 +       if (!read_tag_mmodType(profile, src, index, TAG_mmod))
 +               goto invalid_tag_table;
 +#endif // __APPLE__
 +
         if (find_tag(index, TAG_CHAD)) {
                 profile->chromaticAdaption = read_tag_s15Fixed16ArrayType(src, index, TAG_CHAD);
         } else {
                 profile->chromaticAdaption.invalid = true; //Signal the data is not present
         }
  
 +       if (find_tag(index, TAG_vcgt)) {
 +               if (!read_tag_vcgtType(profile, src, index))
 +                       goto invalid_tag_table;
 +       }
 +
         if (profile->class == DISPLAY_DEVICE_PROFILE || profile->class == INPUT_DEVICE_PROFILE ||
              profile->class == OUTPUT_DEVICE_PROFILE  || profile->class == COLOR_SPACE_PROFILE) {
                 if (profile->color_space == RGB_SIGNATURE) {
-@@ -1098,6 +1350,16 @@ invalid_profile:
+@@ -1098,6 +1354,16 @@ invalid_profile:
         return INVALID_PROFILE;
  }
  
 +qcms_bool qcms_profile_match(qcms_profile *p1, qcms_profile *p2)
 +{
 +    return memcmp(p1->description, p2->description, sizeof p1->description) == 0;
 +}
 +
 +const char* qcms_profile_get_description(qcms_profile *profile)
 +{
 +    return profile->description;
 +}
 +
  qcms_intent qcms_profile_get_rendering_intent(qcms_profile *profile)
  {
         return profile->rendering_intent;
-@@ -1114,6 +1376,18 @@ static void lut_release(struct lutType *lut)
+@@ -1114,6 +1380,18 @@ static void lut_release(struct lutType *lut)
         free(lut);
  }
  
 +size_t qcms_profile_get_vcgt_channel_length(qcms_profile *profile) {
 +       return profile->vcgt.length;
 +}
 +
 +qcms_bool qcms_profile_get_vcgt_rgb_channels(qcms_profile *profile, unsigned short *data) {
 +       size_t vcgt_channel_bytes = qcms_profile_get_vcgt_channel_length(profile) * sizeof(uint16_t);
 +       if (!vcgt_channel_bytes || !data)
 +               return false;
 +       memcpy(data, profile->vcgt.data, 3 * vcgt_channel_bytes);
 +       return true;
 +}
 +
  void qcms_profile_release(qcms_profile *profile)
  {
         if (profile->output_table_r)
-@@ -1133,6 +1407,9 @@ void qcms_profile_release(qcms_profile *profile)
+@@ -1133,6 +1411,9 @@ void qcms_profile_release(qcms_profile *profile)
         if (profile->mBA)
                 mAB_release(profile->mBA);
  
 +       if (profile->vcgt.data)
 +               free(profile->vcgt.data);
 +
         free(profile->redTRC);
         free(profile->blueTRC);
         free(profile->greenTRC);
 diff --git a/third_party/qcms/src/qcms.h b/third_party/qcms/src/qcms.h
@@ skipping 1213 matching lines @@
  
 -float lut_interp_linear(double value, uint16_t *table, int length);
 -float lut_interp_linear_float(float value, float *table, int length);
 -uint16_t lut_interp_linear16(uint16_t input_value, uint16_t *table, int length);
 +float lut_interp_linear(double value, uint16_t *table, size_t length);
 +float lut_interp_linear_float(float value, float *table, size_t length);
 +uint16_t lut_interp_linear16(uint16_t input_value, uint16_t *table, size_t length);
  
  
  static inline float lerp(float a, float b, float t)