qcms: Limit vcgt table to a maximum of 1024 entries

third_party/qcms/src/iccread.c

 /* vim: set ts=8 sw=8 noexpandtab: */
 //  qcms
 //  Copyright (C) 2009 Mozilla Foundation
 //  Copyright (C) 1998-2007 Marti Maria
 //
 // Permission is hereby granted, free of charge, to any person obtaining 
 // a copy of this software and associated documentation files (the "Software"), 
 // to deal in the Software without restriction, including without limitation 
 // the rights to use, copy, modify, merge, publish, distribute, sublicense, 
 // and/or sell copies of the Software, and to permit persons to whom the Software 
@@ skipping 368 matching lines @@
 
         // Only support 3 channels.
         if (channels != 3)
                 return true;
         // Only support single or double byte values.
         if (byte_depth != 1 && byte_depth != 2)
                 return true;
         // Only support table data, not equation.
         if (vcgt_type != 0)
                 return true;
+        // Limit the table to a sensible size; 10-bit gamma is a reasonable
+        // maximum for hardware correction.
+        if (elements > 1024)
+                return true;
 
         // Empty table is invalid.
         if (!elements)
                 goto invalid_vcgt_tag;
 
         profile->vcgt.length = elements;
         profile->vcgt.data = malloc(3 * elements * sizeof(uint16_t));
         if (!profile->vcgt.data)
                 return false;
 
@@ skipping 1073 matching lines @@
 {
         qcms_profile *profile = NULL;
         FILE *file = _wfopen(path, L"rb");
         if (file) {
                 profile = qcms_profile_from_file(file);
                 fclose(file);
         }
         return profile;
 }
 #endif