[M57] lcms upstream patches to fix security bug

third_party/lcms2-2.6/src/cmstypes.c

 //---------------------------------------------------------------------------------
 //
 //  Little Color Management System
 //  Copyright (c) 1998-2014 Marti Maria Saguer
 //
 // Permission is hereby granted, free of charge, to any person obtaining
 // a copy of this software and associated documentation files (the "Software"),
 // to deal in the Software without restriction, including without limitation
 // the rights to use, copy, modify, merge, publish, distribute, sublicense,
 // and/or sell copies of the Software, and to permit persons to whom the Software
@@ skipping 1737 matching lines @@
     if (!_cmsReadUInt8Number(io, &InputChannels)) goto Error;
     if (!_cmsReadUInt8Number(io, &OutputChannels)) goto Error;
     if (!_cmsReadUInt8Number(io, &CLUTpoints)) goto Error;
 
      if (CLUTpoints == 1) goto Error; // Impossible value, 0 for no CLUT and then 2 at least
 
     // Padding
     if (!_cmsReadUInt8Number(io, NULL)) goto Error;
 
     // Do some checking
-    if (InputChannels > cmsMAXCHANNELS)  goto Error;
-    if (OutputChannels > cmsMAXCHANNELS) goto Error;
+    if (InputChannels == 0 || InputChannels > cmsMAXCHANNELS)  goto Error;
+    if (OutputChannels == 0 || OutputChannels > cmsMAXCHANNELS) goto Error;
 
    // Allocates an empty Pipeline
     NewLUT = cmsPipelineAlloc(self ->ContextID, InputChannels, OutputChannels);
     if (NewLUT == NULL) goto Error;
 
     // Read the Matrix
     if (!_cmsRead15Fixed16Number(io,  &Matrix[0])) goto Error;
     if (!_cmsRead15Fixed16Number(io,  &Matrix[1])) goto Error;
     if (!_cmsRead15Fixed16Number(io,  &Matrix[2])) goto Error;
     if (!_cmsRead15Fixed16Number(io,  &Matrix[3])) goto Error;
@@ skipping 271 matching lines @@
     *nItems = 0;
 
     if (!_cmsReadUInt8Number(io, &InputChannels)) return NULL;
     if (!_cmsReadUInt8Number(io, &OutputChannels)) return NULL;
     if (!_cmsReadUInt8Number(io, &CLUTpoints)) return NULL;   // 255 maximum
 
     // Padding
     if (!_cmsReadUInt8Number(io, NULL)) return NULL;
 
     // Do some checking
-    if (InputChannels > cmsMAXCHANNELS)  goto Error;
-    if (OutputChannels > cmsMAXCHANNELS) goto Error;
+    if (InputChannels == 0 || InputChannels > cmsMAXCHANNELS)  goto Error;
+    if (OutputChannels == 0 || OutputChannels > cmsMAXCHANNELS) goto Error;
 
     // Allocates an empty LUT
     NewLUT = cmsPipelineAlloc(self ->ContextID, InputChannels, OutputChannels);
     if (NewLUT == NULL) goto Error;
 
     // Read the Matrix
     if (!_cmsRead15Fixed16Number(io,  &Matrix[0])) goto Error;
     if (!_cmsRead15Fixed16Number(io,  &Matrix[1])) goto Error;
     if (!_cmsRead15Fixed16Number(io,  &Matrix[2])) goto Error;
     if (!_cmsRead15Fixed16Number(io,  &Matrix[3])) goto Error;
@@ skipping 416 matching lines @@
     if (!_cmsReadUInt8Number(io, &outputChan)) return NULL;
 
     if (!_cmsReadUInt16Number(io, NULL)) return NULL;
 
     if (!_cmsReadUInt32Number(io, &offsetB)) return NULL;
     if (!_cmsReadUInt32Number(io, &offsetMat)) return NULL;
     if (!_cmsReadUInt32Number(io, &offsetM)) return NULL;
     if (!_cmsReadUInt32Number(io, &offsetC)) return NULL;
     if (!_cmsReadUInt32Number(io, &offsetA)) return NULL;
 
-   // Allocates an empty LUT
+    if (inputChan == 0 || inputChan >= cmsMAXCHANNELS) return NULL;
+    if (outputChan == 0 || outputChan >= cmsMAXCHANNELS) return NULL;
+
+    // Allocates an empty LUT
     NewLUT = cmsPipelineAlloc(self ->ContextID, inputChan, outputChan);
     if (NewLUT == NULL) return NULL;
 
     if (offsetA!= 0) {
         if (!cmsPipelineInsertStage(NewLUT, cmsAT_END, ReadSetOfCurves(self, io, BaseOffset + offsetA, inputChan)))
             goto Error;
     }
 
     if (offsetC != 0) {
         if (!cmsPipelineInsertStage(NewLUT, cmsAT_END, ReadCLUT(self, io, BaseOffset + offsetC, inputChan, outputChan)))
@@ skipping 287 matching lines @@
     cmsUInt32Number      offsetC;        // Offset to CLUT
     cmsUInt32Number      offsetA;        // Offset to first "A" curve
     cmsPipeline* NewLUT = NULL;
 
 
     BaseOffset = io ->Tell(io) - sizeof(_cmsTagBase);
 
     if (!_cmsReadUInt8Number(io, &inputChan)) return NULL;
     if (!_cmsReadUInt8Number(io, &outputChan)) return NULL;
 
+    if (inputChan == 0 || inputChan >= cmsMAXCHANNELS) return NULL;
+    if (outputChan == 0 || outputChan >= cmsMAXCHANNELS) return NULL;
+
     // Padding
     if (!_cmsReadUInt16Number(io, NULL)) return NULL;
 
     if (!_cmsReadUInt32Number(io, &offsetB)) return NULL;
     if (!_cmsReadUInt32Number(io, &offsetMat)) return NULL;
     if (!_cmsReadUInt32Number(io, &offsetM)) return NULL;
     if (!_cmsReadUInt32Number(io, &offsetC)) return NULL;
     if (!_cmsReadUInt32Number(io, &offsetA)) return NULL;
 
     // Allocates an empty LUT
@@ skipping 1629 matching lines @@
     cmsPipeline *NewLUT = NULL;
     cmsUInt32Number BaseOffset;
 
     // Get actual position as a basis for element offsets
     BaseOffset = io ->Tell(io) - sizeof(_cmsTagBase);
 
     // Read channels and element count
     if (!_cmsReadUInt16Number(io, &InputChans)) return NULL;
     if (!_cmsReadUInt16Number(io, &OutputChans)) return NULL;
 
+    if (InputChans == 0 || InputChans >= cmsMAXCHANNELS) return NULL;
+    if (OutputChans == 0 || OutputChans >= cmsMAXCHANNELS) return NULL;
+
     // Allocates an empty LUT
     NewLUT = cmsPipelineAlloc(self ->ContextID, InputChans, OutputChans);
     if (NewLUT == NULL) return NULL;
 
     if (!_cmsReadUInt32Number(io, &ElementCount)) return NULL;
 
     if (!ReadPositionTable(self, io, ElementCount, BaseOffset, NewLUT, ReadMPEElem)) {
         if (NewLUT != NULL) cmsPipelineFree(NewLUT);
         *nItems = 0;
         return NULL;
@@ skipping 1125 matching lines @@
 
     for (pt = SupportedTags;
             pt != NULL;
             pt = pt ->Next) {
 
                 if (sig == pt -> Signature) return &pt ->Descriptor;
     }
 
     return NULL;
 }