[M57] lcms upstream patches to fix security bug

third_party/lcms2-2.6/src/cmslut.c

 //---------------------------------------------------------------------------------
 //
 //  Little Color Management System
 //  Copyright (c) 1998-2012 Marti Maria Saguer
 //
 // Permission is hereby granted, free of charge, to any person obtaining
 // a copy of this software and associated documentation files (the "Software"),
 // to deal in the Software without restriction, including without limitation
 // the rights to use, copy, modify, merge, publish, distribute, sublicense,
 // and/or sell copies of the Software, and to permit persons to whom the Software
@@ skipping 1237 matching lines @@
         NewMPE ->Data       = NULL;
     }
 
     return NewMPE;
 }
 
 
 // ***********************************************************************************************************
 
 // This function sets up the channel count
-
 static
-void BlessLUT(cmsPipeline* lut)
+cmsBool BlessLUT(cmsPipeline* lut)
 {
     // We can set the input/ouput channels only if we have elements.
     if (lut ->Elements != NULL) {
 
-        cmsStage *First, *Last;
+        cmsStage* prev;
+        cmsStage* next;
+        cmsStage* First;
+        cmsStage* Last;
 
         First  = cmsPipelineGetPtrToFirstStage(lut);
         Last   = cmsPipelineGetPtrToLastStage(lut);
 
-        if (First != NULL)lut ->InputChannels = First ->InputChannels;
-        if (Last != NULL) lut ->OutputChannels = Last ->OutputChannels;
+        if (First == NULL || Last == NULL) return FALSE;
+
+        lut->InputChannels = First->InputChannels;
+        lut->OutputChannels = Last->OutputChannels;
+
+        // Check chain consistency
+        prev = First;
+        next = prev->Next;
+
+        while (next != NULL)
+        {
+            if (next->InputChannels != prev->OutputChannels)
+                return FALSE;
+
+            next = next->Next;
+            prev = prev->Next;
+        }
     }
+    return TRUE;    
 }
 
 
 // Default to evaluate the LUT on 16 bit-basis. Precision is retained.
 static
 void _LUTeval16(register const cmsUInt16Number In[], register cmsUInt16Number Out[],  register const void* D)
 {
     cmsPipeline* lut = (cmsPipeline*) D;
     cmsStage *mpe;
     cmsFloat32Number Storage[2][MAX_STAGE_CHANNELS] = {0.0f};
@@ skipping 41 matching lines @@
 
 
 
 
 // LUT Creation & Destruction
 
 cmsPipeline* CMSEXPORT cmsPipelineAlloc(cmsContext ContextID, cmsUInt32Number InputChannels, cmsUInt32Number OutputChannels)
 {
        cmsPipeline* NewLUT;
 
+       // A value of zero in channels is allowed as placeholder
        if (InputChannels >= cmsMAXCHANNELS ||
            OutputChannels >= cmsMAXCHANNELS) return NULL;
 
        NewLUT = (cmsPipeline*) _cmsMallocZero(ContextID, sizeof(cmsPipeline));
        if (NewLUT == NULL) return NULL;
 
 
        NewLUT -> InputChannels  = InputChannels;
        NewLUT -> OutputChannels = OutputChannels;
 
        NewLUT ->Eval16Fn    = _LUTeval16;
        NewLUT ->EvalFloatFn = _LUTevalFloat;
        NewLUT ->DupDataFn   = NULL;
        NewLUT ->FreeDataFn  = NULL;
        NewLUT ->Data        = NewLUT;
        NewLUT ->ContextID   = ContextID;
 
-       BlessLUT(NewLUT);
+       if (!BlessLUT(NewLUT))
+       {
+           _cmsFree(ContextID, NewLUT);
+           return NULL;
+       }
 
        return NewLUT;
 }
 
 cmsContext CMSEXPORT cmsGetPipelineContextID(const cmsPipeline* lut)
 {
     _cmsAssert(lut != NULL);
     return lut ->ContextID;
 }
 
@@ skipping 85 matching lines @@
     NewLUT ->EvalFloatFn = lut ->EvalFloatFn;
     NewLUT ->DupDataFn   = lut ->DupDataFn;
     NewLUT ->FreeDataFn  = lut ->FreeDataFn;
 
     if (NewLUT ->DupDataFn != NULL)
         NewLUT ->Data = NewLUT ->DupDataFn(lut ->ContextID, lut->Data);
 
 
     NewLUT ->SaveAs8Bits    = lut ->SaveAs8Bits;
 
-    BlessLUT(NewLUT);
+    if (!BlessLUT(NewLUT))
+    {
+        _cmsFree(lut->ContextID, NewLUT);
+        return NULL;
+    }
+
     return NewLUT;
 }
 
 
 int CMSEXPORT cmsPipelineInsertStage(cmsPipeline* lut, cmsStageLoc loc, cmsStage* mpe)
 {
     cmsStage* Anterior = NULL, *pt;
 
     if (lut == NULL || mpe == NULL)
         return FALSE;
@@ skipping 16 matching lines @@
                      pt = pt -> Next) Anterior = pt;
 
                 Anterior ->Next = mpe;
                 mpe ->Next = NULL;
             }
             break;
         default:;
             return FALSE;
     }
 
-    BlessLUT(lut);
-    return TRUE;
+    return BlessLUT(lut);    
 }
 
 // Unlink an element and return the pointer to it
 void CMSEXPORT cmsPipelineUnlinkStage(cmsPipeline* lut, cmsStageLoc loc, cmsStage** mpe)
 {
     cmsStage *Anterior, *pt, *Last;
     cmsStage *Unlinked = NULL;
 
 
     // If empty LUT, there is nothing to remove
@@ skipping 34 matching lines @@
                 lut ->Elements = NULL;
             break;
         default:;
     }
 
     if (mpe)
         *mpe = Unlinked;
     else
         cmsStageFree(Unlinked);
 
+    // May fail, but we ignore it
     BlessLUT(lut);
 }
 
 
 // Concatenate two LUT into a new single one
 cmsBool  CMSEXPORT cmsPipelineCat(cmsPipeline* l1, const cmsPipeline* l2)
 {
     cmsStage* mpe;
 
     // If both LUTS does not have elements, we need to inherit
     // the number of channels
     if (l1 ->Elements == NULL && l2 ->Elements == NULL) {
         l1 ->InputChannels  = l2 ->InputChannels;
         l1 ->OutputChannels = l2 ->OutputChannels;
     }
 
     // Cat second
     for (mpe = l2 ->Elements;
          mpe != NULL;
          mpe = mpe ->Next) {
 
             // We have to dup each element
             if (!cmsPipelineInsertStage(l1, cmsAT_END, cmsStageDup(mpe)))
                 return FALSE;
     }
 
-    BlessLUT(l1);
-    return TRUE;
+    return BlessLUT(l1);    
 }
 
 
 cmsBool CMSEXPORT cmsPipelineSetSaveAs8bitsFlag(cmsPipeline* lut, cmsBool On)
 {
     cmsBool Anterior = lut ->SaveAs8Bits;
 
     lut ->SaveAs8Bits = On;
     return Anterior;
 }
@@ skipping 196 matching lines @@
         // Some clipping....
         for (j=0; j < 3; j++) {
             if (x[j] < 0) x[j] = 0;
             else
                 if (x[j] > 1.0) x[j] = 1.0;
         }
     }
 
     return TRUE;
 }