pdfium: Fix inconsistent number of color components of ICC profile

core/fxcodec/codec/fx_codec_icc.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fxcodec/codec/codec_int.h"
 #include "core/fxcodec/fx_codec.h"
 #include "third_party/lcms2-2.6/include/lcms2.h"
 
-const uint32_t N_COMPONENT_LAB = 3;
-const uint32_t N_COMPONENT_GRAY = 1;
-const uint32_t N_COMPONENT_RGB = 3;
-const uint32_t N_COMPONENT_CMYK = 4;
-const uint32_t N_COMPONENT_DEFAULT = 3;
-
 struct CLcmsCmm {
   cmsHTRANSFORM m_hTransform;
   int m_nSrcComponents;
   int m_nDstComponents;
   bool m_bLab;
 };
 bool CheckComponents(cmsColorSpaceSignature cs, int nComponents, bool bDst) {
   if (nComponents <= 0 || nComponents > 15) {
     return false;
   }
@@ skipping 23 matching lines @@
       break;
     default:
       if (nComponents != 3) {
         return false;
       }
       break;
   }
   return true;
 }
 
-uint32_t GetCSComponents(cmsColorSpaceSignature cs) {
-  uint32_t components;
-  switch (cs) {
-    case cmsSigLabData:
-      components = N_COMPONENT_LAB;
-      break;
-    case cmsSigGrayData:
-      components = N_COMPONENT_GRAY;
-      break;
-    case cmsSigRgbData:
-      components = N_COMPONENT_RGB;
-      break;
-    case cmsSigCmykData:
-      components = N_COMPONENT_CMYK;
-      break;
-    default:
-      components = N_COMPONENT_DEFAULT;
-      break;
-  }
-  return components;
-}
-
 void* IccLib_CreateTransform(const unsigned char* pSrcProfileData,
                              uint32_t dwSrcProfileSize,
                              uint32_t& nSrcComponents,
                              const unsigned char* pDstProfileData,
                              uint32_t dwDstProfileSize,
                              int32_t nDstComponents,
                              int intent,
                              uint32_t dwSrcFormat = Icc_FORMAT_DEFAULT,
                              uint32_t dwDstFormat = Icc_FORMAT_DEFAULT) {
   nSrcComponents = 0;
   cmsHPROFILE srcProfile =
       cmsOpenProfileFromMem((void*)pSrcProfileData, dwSrcProfileSize);
   if (!srcProfile)
     return nullptr;
 
   cmsHPROFILE dstProfile;
   if (!pDstProfileData && dwDstProfileSize == 0 && nDstComponents == 3) {
     dstProfile = cmsCreate_sRGBProfile();
   } else {
     dstProfile =
         cmsOpenProfileFromMem((void*)pDstProfileData, dwDstProfileSize);
   }
   if (!dstProfile) {
     cmsCloseProfile(srcProfile);
     return nullptr;
   }
   int srcFormat;
   bool bLab = false;
   cmsColorSpaceSignature srcCS = cmsGetColorSpace(srcProfile);
-  nSrcComponents = GetCSComponents(srcCS);
+
+  nSrcComponents = cmsChannelsOf(srcCS);
+  // According to PDF spec, number of components must be 1, 3, or 4.
+  if (nSrcComponents != 1 && nSrcComponents != 3 && nSrcComponents != 4) {
+    cmsCloseProfile(srcProfile);
+    cmsCloseProfile(dstProfile);
+    return nullptr;
+  }
+
   if (srcCS == cmsSigLabData) {
     srcFormat =
         COLORSPACE_SH(PT_Lab) | CHANNELS_SH(nSrcComponents) | BYTES_SH(0);
     bLab = true;
   } else {
     srcFormat =
         COLORSPACE_SH(PT_ANY) | CHANNELS_SH(nSrcComponents) | BYTES_SH(1);
     if (srcCS == cmsSigRgbData && T_DOSWAP(dwSrcFormat)) {
       srcFormat |= DOSWAP_SH(1);
     }
@@ skipping 1557 matching lines @@
   ASSERT(k1 == FXSYS_round(k * 255));
 
   uint8_t r, g, b;
   AdobeCMYK_to_sRGB1(c1, m1, y1, k1, r, g, b);
   // Multiply by a constant rather than dividing because division is much
   // more expensive.
   R = r * (1.0f / 255);
   G = g * (1.0f / 255);
   B = b * (1.0f / 255);
 }