Fix infinite loop when calling GrowNamedColorList

third_party/lcms2-2.6/src/cmsnamed.c

 //---------------------------------------------------------------------------------
 //
 //  Little Color Management System
 //  Copyright (c) 1998-2012 Marti Maria Saguer
 //
 // Permission is hereby granted, free of charge, to any person obtaining
 // a copy of this software and associated documentation files (the "Software"),
 // to deal in the Software without restriction, including without limitation
 // the rights to use, copy, modify, merge, publish, distribute, sublicense,
 // and/or sell copies of the Software, and to permit persons to whom the Software
@@ skipping 496 matching lines @@
 cmsNAMEDCOLORLIST* CMSEXPORT cmsAllocNamedColorList(cmsContext ContextID, cmsUInt32Number n, cmsUInt32Number ColorantCount, const char* Prefix, const char* Suffix)
 {
     cmsNAMEDCOLORLIST* v = (cmsNAMEDCOLORLIST*) _cmsMallocZero(ContextID, sizeof(cmsNAMEDCOLORLIST));
 
     if (v == NULL) return NULL;
 
     v ->List      = NULL;
     v ->nColors   = 0;
     v ->ContextID  = ContextID;
 
-    while (v -> Allocated < n)
-        GrowNamedColorList(v);
+    while (v -> Allocated < n) {
+        if (!GrowNamedColorList(v)) {
+            cmsFreeNamedColorList(v);
+            return NULL;
+        }
+    }
 
     strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix)-1);
     strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix)-1);
     v->Prefix[32] = v->Suffix[32] = 0;
 
     v -> ColorantCount = ColorantCount;
 
     return v;
 }
 
 // Free a list
 void CMSEXPORT cmsFreeNamedColorList(cmsNAMEDCOLORLIST* v)
 {
     if (v == NULL) return;
     if (v ->List) _cmsFree(v ->ContextID, v ->List);
     _cmsFree(v ->ContextID, v);
 }
 
 cmsNAMEDCOLORLIST* CMSEXPORT cmsDupNamedColorList(const cmsNAMEDCOLORLIST* v)
 {
     cmsNAMEDCOLORLIST* NewNC;
 
     if (v == NULL) return NULL;
 
     NewNC= cmsAllocNamedColorList(v ->ContextID, v -> nColors, v ->ColorantCount, v ->Prefix, v ->Suffix);
     if (NewNC == NULL) return NULL;
 
     // For really large tables we need this
-    while (NewNC ->Allocated < v ->Allocated)
-        GrowNamedColorList(NewNC);
+    while (NewNC ->Allocated < v ->Allocated) {
+        if (!GrowNamedColorList(NewNC)) {
+            cmsFreeNamedColorList(NewNC);
+            return NULL;
+        }
+    }
 
     memmove(NewNC ->Prefix, v ->Prefix, sizeof(v ->Prefix));
     memmove(NewNC ->Suffix, v ->Suffix, sizeof(v ->Suffix));
     NewNC ->ColorantCount = v ->ColorantCount;
     memmove(NewNC->List, v ->List, v->nColors * sizeof(_cmsNAMEDCOLOR));
     NewNC ->nColors = v ->nColors;
     return NewNC;
 }
 
 
@@ skipping 361 matching lines @@
     if (dict == NULL) return NULL;
     return dict ->head;
 }
 
 // Helper For external languages
 const cmsDICTentry* CMSEXPORT cmsDictNextEntry(const cmsDICTentry* e)
 {
      if (e == NULL) return NULL;
      return e ->Next;
 }