Add checks for bogus profiles to SkColorSpace::NewICC()

src/core/SkColorSpace_ICC.cpp

Index: src/core/SkColorSpace_ICC.cpp
diff --git a/src/core/SkColorSpace_ICC.cpp b/src/core/SkColorSpace_ICC.cpp
index b33e6b5ba19bad70d7c32352fb403f1f71bdbf25..3895e47b0eb4b7bf8a73b95b53e7597e80c8fae3 100644
--- a/src/core/SkColorSpace_ICC.cpp
+++ b/src/core/SkColorSpace_ICC.cpp
@@ -110,7 +110,7 @@ struct ICCProfileHeader {
     }
 
     bool valid() const {
-        return_if_false(fSize >= kICCHeaderSize, "Size is too small");
+        SkASSERT(fSize >= kICCHeaderSize);
 
         uint8_t majorVersion = fVersion >> 24;
         return_if_false(majorVersion <= 4, "Unsupported version");
@@ -149,6 +149,7 @@ struct ICCProfileHeader {
                         color_space_almost_equal(SkFixedToFloat(fIlluminantXYZ[2]), 0.82491f),
                         "Illuminant must be D50");
 
+        // Arbitrary, but there's no reason to exceed 100 tags.
         return_if_false(fTagCount <= 100, "Too many tags");
 
         return true;
@@ -291,6 +292,13 @@ static SkGammas::Type parse_gamma(SkGammas::Data* outData, SkColorSpaceTransferF
         case kTAG_CurveType: {
             uint32_t count = read_big_endian_u32(src + 8);
 
+            // This is arbitrary, but one million entries is more than enough for a table.
+            static constexpr size_t kMaxGammaTableSize = 2 << 20;
+            if (count > kMaxGammaTableSize) {
+                SkColorSpacePrintf("Gamma table too large");
+                return SkGammas::Type::kNone_Type;
+            }
+
             // tagBytes = 12 + 2 * count
             // We need to do safe addition here to avoid integer overflow.
             if (!safe_add(count, count, &tagBytes) ||
@@ -873,7 +881,10 @@ static bool tag_equals(const ICCTag* a, const ICCTag* b, const uint8_t* base) {
 }
 
 sk_sp<SkColorSpace> SkColorSpace::NewICC(const void* input, size_t len) {
-    if (!input || len < kICCHeaderSize) {
+    // This is arbitrary, but there's no need for a sane profile to exceed 4 MB.
+    static constexpr size_t kMaxICCSize = 2 << 22;
+
+    if (!input || kICCHeaderSize > len || len > kMaxICCSize) {
         return_null("Data is null or not large enough to contain an ICC profile");
     }