Add checks for bogus profiles to SkColorSpace::NewICC()

src/core/SkColorSpace_ICC.cpp

 /*
  * Copyright 2016 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkColorSpace.h"
 #include "SkColorSpace_Base.h"
 #include "SkColorSpacePriv.h"
@@ skipping 92 matching lines @@
     void init(const uint8_t* src, size_t len) {
         SkASSERT(kICCHeaderSize == sizeof(*this));
 
         uint32_t* dst = (uint32_t*) this;
         for (uint32_t i = 0; i < kICCHeaderSize / 4; i++, src+=4) {
             dst[i] = read_big_endian_u32(src);
         }
     }
 
     bool valid() const {
-        return_if_false(fSize >= kICCHeaderSize, "Size is too small");
+        SkASSERT(fSize >= kICCHeaderSize);
 
         uint8_t majorVersion = fVersion >> 24;
         return_if_false(majorVersion <= 4, "Unsupported version");
 
         // These are the four basic classes of profiles that we might expect to see embedded
         // in images.  Additional classes exist, but they generally are used as a convenient
         // way for CMMs to store calculated transforms.
         return_if_false(fProfileClass == kDisplay_Profile ||
                         fProfileClass == kInput_Profile ||
                         fProfileClass == kOutput_Profile ||
@@ skipping 18 matching lines @@
             // Warn rather than fail here.  Occasionally, we see perfectly
             // normal profiles with wacky rendering intents.
             SkColorSpacePrintf("Warning, bad rendering intent.\n");
         }
 
         return_if_false(color_space_almost_equal(SkFixedToFloat(fIlluminantXYZ[0]), 0.96420f) &&
                         color_space_almost_equal(SkFixedToFloat(fIlluminantXYZ[1]), 1.00000f) &&
                         color_space_almost_equal(SkFixedToFloat(fIlluminantXYZ[2]), 0.82491f),
                         "Illuminant must be D50");
 
+        // Arbitrary, but there's no reason to exceed 100 tags.
         return_if_false(fTagCount <= 100, "Too many tags");
 
         return true;
     }
 };
 
 template <class T>
 static bool safe_add(T arg1, T arg2, size_t* result) {
     SkASSERT(arg1 >= 0);
     SkASSERT(arg2 >= 0);
@@ skipping 122 matching lines @@
     // In the case of consecutive gamma tags, we need to count the number of bytes in the
     // tag, so that we can move on to the next tag.
     size_t tagBytes;
 
     uint32_t type = read_big_endian_u32(src);
     // Bytes 4-7 are reserved and should be set to zero.
     switch (type) {
         case kTAG_CurveType: {
             uint32_t count = read_big_endian_u32(src + 8);
 
+            // This is arbitrary, but one million entries is more than enough for a table.
+            static constexpr size_t kMaxGammaTableSize = 2 << 20;
+            if (count > kMaxGammaTableSize) {
+                SkColorSpacePrintf("Gamma table too large");
+                return SkGammas::Type::kNone_Type;
+            }
+
             // tagBytes = 12 + 2 * count
             // We need to do safe addition here to avoid integer overflow.
             if (!safe_add(count, count, &tagBytes) ||
                 !safe_add((size_t) 12, tagBytes, &tagBytes))
             {
                 SkColorSpacePrintf("Invalid gamma count");
                 return SkGammas::Type::kNone_Type;
             }
 
             if (len < tagBytes) {
@@ skipping 562 matching lines @@
     }
 
     if (a->fOffset == b->fOffset) {
         return true;
     }
 
     return !memcmp(a->addr(base), b->addr(base), a->fLength);
 }
 
 sk_sp<SkColorSpace> SkColorSpace::NewICC(const void* input, size_t len) {
-    if (!input || len < kICCHeaderSize) {
+    // This is arbitrary, but there's no need for a sane profile to exceed 4 MB.
+    static constexpr size_t kMaxICCSize = 2 << 22;
+
+    if (!input || kICCHeaderSize > len || len > kMaxICCSize) {
         return_null("Data is null or not large enough to contain an ICC profile");
     }
 
     // Create our own copy of the input.
     void* memory = sk_malloc_throw(len);
     memcpy(memory, input, len);
     sk_sp<SkData> data = SkData::MakeFromMalloc(memory, len);
     const uint8_t* base = data->bytes();
     const uint8_t* ptr = base;
 
@@ skipping 415 matching lines @@
     ptr32[4] = SkEndian_SwapBE32(0x000116cc);
     ptr += kTAG_XYZ_Bytes;
 
     // Write copyright tag
     memcpy(ptr, gEmptyTextTag, sizeof(gEmptyTextTag));
 
     // TODO (msarett): Should we try to hold onto the data so we can return immediately if
     //                 the client calls again?
     return SkData::MakeFromMalloc(profile.release(), kICCProfileSize);
 }