Fix use uninitialized value and stack buffer overflow read

third_party/lcms2-2.6/src/cmstypes.c

 //---------------------------------------------------------------------------------
 //
 //  Little Color Management System
 //  Copyright (c) 1998-2014 Marti Maria Saguer
 //
 // Permission is hereby granted, free of charge, to any person obtaining
 // a copy of this software and associated documentation files (the "Software"),
 // to deal in the Software without restriction, including without limitation
 // the rights to use, copy, modify, merge, publish, distribute, sublicense,
 // and/or sell copies of the Software, and to permit persons to whom the Software
@@ skipping 2946 matching lines @@
 value. The first colorant listed is the colorant of the first device channel of
 a lut tag. The second colorant listed is the colorant of the second device channel
 of a lut tag, and so on.
 */
 
 static
 void *Type_ColorantTable_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* io, cmsUInt32Number* nItems, cmsUInt32Number SizeOfTag)
 {
     cmsUInt32Number i, Count;
     cmsNAMEDCOLORLIST* List;
     char Name[34];

[Tom Sepez, 2016/09/22 19:24:45]

nit: can we make this Name[33] to avoid questions about what the additional byte
beyond the NUL is for?

[kcwu, 2016/09/22 19:31:43]

Done.

     cmsUInt16Number PCS[3];
 
 
     if (!_cmsReadUInt32Number(io, &Count)) return NULL;
 
     if (Count > cmsMAXCHANNELS) {
         cmsSignalError(self->ContextID, cmsERROR_RANGE, "Too many colorants '%d'", Count);
         return NULL;
     }
 
     List = cmsAllocNamedColorList(self ->ContextID, Count, 0, "", "");
     for (i=0; i < Count; i++) {
 
         if (io ->Read(io, Name, 32, 1) != 1) goto Error;
-        Name[33] = 0;
+        Name[32] = 0;
 
         if (!_cmsReadUInt16Array(io, 3, PCS)) goto Error;
 
         if (!cmsAppendNamedColor(List, Name, PCS, NULL)) goto Error;
 
     }
 
     *nItems = 1;
     return List;
 
@@ skipping 106 matching lines @@
         return 0;
     }
     for (i=0; i < count; i++) {
 
         cmsUInt16Number PCS[3];
         cmsUInt16Number Colorant[cmsMAXCHANNELS];
         char Root[33];
 
         memset(Colorant, 0, sizeof(Colorant));
         if (io -> Read(io, Root, 32, 1) != 1) return NULL;
+        Root[32] = 0;
         if (!_cmsReadUInt16Array(io, 3, PCS)) goto Error;
         if (!_cmsReadUInt16Array(io, nDeviceCoords, Colorant)) goto Error;
 
         if (!cmsAppendNamedColor(v, Root, PCS, Colorant)) goto Error;
     }
 
     *nItems = 1;
     return (void*) v ;
 
 Error:
@@ skipping 2436 matching lines @@
 
     for (pt = SupportedTags;
             pt != NULL;
             pt = pt ->Next) {
 
                 if (sig == pt -> Signature) return &pt ->Descriptor;
     }
 
     return NULL;
 }