Sanitize parsing of color look-up table

src/core/SkColorSpace.cpp

 /*
  * Copyright 2016 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkColorSpace.h"
 #include "SkColorSpace_Base.h"
 #include "SkEndian.h"
@@ skipping 301 matching lines @@
     if (arg1 >= 0 && arg2 <= std::numeric_limits<T>::max() - arg1) {
         T sum = arg1 + arg2;
         if (sum <= std::numeric_limits<size_t>::max()) {
             *result = static_cast<size_t>(sum);
             return true;
         }
     }
     return false;
 }
 
+static bool safe_mul(uint32_t arg1, uint32_t arg2, uint32_t* result) {
+    uint64_t product64 = (uint64_t) arg1 * (uint64_t) arg2;
+    uint32_t product32 = (uint32_t) product64;
+    if (product32 != product64) {
+        return false;
+    }
+
+    *result = product32;
+    return true;
+}
+
 struct ICCTag {
     uint32_t fSignature;
     uint32_t fOffset;
     uint32_t fLength;
 
     const uint8_t* init(const uint8_t* src) {
         fSignature = read_big_endian_uint(src);
         fOffset = read_big_endian_uint(src + 4);
         fLength = read_big_endian_uint(src + 8);
         return src + 12;
@@ skipping 323 matching lines @@
 }
 
 static constexpr uint32_t kTAG_AtoBType = SkSetFourByteTag('m', 'A', 'B', ' ');
 
 bool load_color_lut(SkColorLookUpTable* colorLUT, uint32_t inputChannels, uint32_t outputChannels,
                     const uint8_t* src, size_t len) {
     if (len < 20) {
         SkColorSpacePrintf("Color LUT tag is too small (%d bytes).", len);
         return false;
     }
+    size_t dataLen = len - 20;

[kjlubick, 2016/06/20 14:27:23]

Where's the magic number 20 coming from?

[msarett, 2016/06/20 14:44:11]

20 is the number of bytes preceding the actual color LUT data.  I think Patch
Set 2 makes this much more clear.

 
     SkASSERT(inputChannels <= SkColorLookUpTable::kMaxChannels && 3 == outputChannels);
     colorLUT->fInputChannels = inputChannels;
     colorLUT->fOutputChannels = outputChannels;
     uint32_t numEntries = 1;
     for (uint32_t i = 0; i < inputChannels; i++) {
         colorLUT->fGridPoints[i] = src[i];
-        numEntries *= src[i];
+        if (0 == src[i]) {
+            SkColorSpacePrintf("Each input channel must have at least one grid point.");
+            return false;
+        }
+
+        if (!safe_mul(numEntries, src[i], &numEntries)) {
+            SkColorSpacePrintf("Too many entries in Color LUT.");
+            return false;
+        }
     }
-    numEntries *= outputChannels;
+
+    if (!safe_mul(numEntries, outputChannels, &numEntries)) {
+        SkColorSpacePrintf("Too many entries in Color LUT.");
+        return false;
+    }
 
     // Space is provided for a maximum of the 16 input channels.  Now we determine the precision
     // of the table values.
     uint8_t precision = src[16];
     switch (precision) {
         case 1: // 8-bit data
         case 2: // 16-bit data
             break;
         default:
-            SkColorSpacePrintf("Color LUT precision must be 8-bit or 16-bit.\n", len);
+            SkColorSpacePrintf("Color LUT precision must be 8-bit or 16-bit.\n");
             return false;
     }
 
-    if (len < 20 + numEntries * precision) {
+    uint32_t clutBytes;
+    if (!safe_mul(numEntries, precision, &clutBytes)) {
+        SkColorSpacePrintf("Too many entries in Color LUT.");
+        return false;
+    }
+
+    if (dataLen < clutBytes) {
         SkColorSpacePrintf("Color LUT tag is too small (%d bytes).", len);
         return false;
     }
 
     // Movable struct colorLUT has ownership of fTable.
     colorLUT->fTable = std::unique_ptr<float[]>(new float[numEntries]);
     const uint8_t* ptr = src + 20;
     for (uint32_t i = 0; i < numEntries; i++, ptr += precision) {
         if (1 == precision) {
             colorLUT->fTable[i] = ((float) ptr[i]) / 255.0f;
@@ skipping 469 matching lines @@
     ptr32[4] = SkEndian_SwapBE32(0x000116cc);
     ptr += kTAG_XYZ_Bytes;
 
     // Write copyright tag
     memcpy(ptr, gEmptyTextTag, sizeof(gEmptyTextTag));
 
     // TODO (msarett): Should we try to hold onto the data so we can return immediately if
     //                 the client calls again?
     return SkData::MakeFromMalloc(profile.release(), kICCProfileSize);
 }