qcms: Limit vcgt table to a maximum of 1024 entries

third_party/qcms/src/iccread.c

Index: third_party/qcms/src/iccread.c
diff --git a/third_party/qcms/src/iccread.c b/third_party/qcms/src/iccread.c
index 18b286ddbd973dafedfd7698925c52e95a7edb6f..0deab10a3d06886e8253f520534423a902affd48 100644
--- a/third_party/qcms/src/iccread.c
+++ b/third_party/qcms/src/iccread.c
@@ -386,6 +386,10 @@ qcms_bool read_tag_vcgtType(qcms_profile *profile, struct mem_source *src, struc
 	// Only support table data, not equation.
 	if (vcgt_type != 0)
 		return true;
+	// Limit the table to a sensible size; 10-bit gamma is a reasonable
+	// maximum for hardware correction.
+	if (elements > 1024)
+		return true;
 
 	// Empty table is invalid.
 	if (!elements)