lcms: backport upstream commit c0a98d86

third_party/lcms2-2.6/src/cmsio0.c

Index: third_party/lcms2-2.6/src/cmsio0.c
diff --git a/third_party/lcms2-2.6/src/cmsio0.c b/third_party/lcms2-2.6/src/cmsio0.c
index 5f9f08a6f8b68515385a67f6bfce242162682827..3ed730a92a8b7a20aa72b1d901c6b78faa1fba98 100644
--- a/third_party/lcms2-2.6/src/cmsio0.c
+++ b/third_party/lcms2-2.6/src/cmsio0.c
@@ -1475,6 +1475,17 @@ void* CMSEXPORT cmsReadTag(cmsHPROFILE hProfile, cmsTagSignature sig)
     // If the element is already in memory, return the pointer
     if (Icc -> TagPtrs[n]) {
 
+        if (Icc->TagTypeHandlers[n] == NULL) goto Error;
+
+        // Sanity check
+        BaseType = Icc->TagTypeHandlers[n]->Signature;
+        if (BaseType == 0) goto Error;
+
+        TagDescriptor = _cmsGetTagDescriptor(Icc->ContextID, sig);
+        if (TagDescriptor == NULL) goto Error;
+
+        if (!IsTypeSupported(TagDescriptor, BaseType)) goto Error;
+
         if (Icc ->TagSaveAsRaw[n]) goto Error;  // We don't support read raw tags as cooked
 
         _cmsUnlockMutex(Icc->ContextID, Icc ->UsrMutex);