[qcms] Only accept valid input ranges when reading VCGT formula

third_party/qcms/src/iccread.c

 /* vim: set ts=8 sw=8 noexpandtab: */
 //  qcms
 //  Copyright (C) 2009 Mozilla Foundation
 //  Copyright (C) 1998-2007 Marti Maria
 //
-// Permission is hereby granted, free of charge, to any person obtaining 
-// a copy of this software and associated documentation files (the "Software"), 
-// to deal in the Software without restriction, including without limitation 
-// the rights to use, copy, modify, merge, publish, distribute, sublicense, 
-// and/or sell copies of the Software, and to permit persons to whom the Software 
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the "Software"),
+// to deal in the Software without restriction, including without limitation
+// the rights to use, copy, modify, merge, publish, distribute, sublicense,
+// and/or sell copies of the Software, and to permit persons to whom the Software
 // is furnished to do so, subject to the following conditions:
 //
-// The above copyright notice and this permission notice shall be included in 
+// The above copyright notice and this permission notice shall be included in
 // all copies or substantial portions of the Software.
 //
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
-// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO 
-// THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
-// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE 
-// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION 
-// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION 
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO
+// THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 // WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 #include <math.h>
 #include <assert.h>
 #include <stdlib.h>
 #include <string.h> //memset
 #include "qcmsint.h"
 
 /* It might be worth having a unified limit on content controlled
  * allocation per profile. This would remove the need for many
@@ skipping 440 matching lines @@
                         float gamma = s15Fixed16Number_to_float(
                                         read_s15Fixed16Number(src, formula_offset + 12 * i));
                         float min = s15Fixed16Number_to_float(
                                         read_s15Fixed16Number(src, formula_offset + 4 + 12 * i));
                         float max = s15Fixed16Number_to_float(
                                         read_s15Fixed16Number(src, formula_offset + 8 + 12 * i));
                         float range = max - min;
 
                         if (!src->valid)
                                 goto invalid_vcgt_tag;
+      if (gamma <= 0)
+        goto invalid_vcgt_tag;
+      if (min <= 0 || min > 1.f)
+        goto invalid_vcgt_tag;
+      if (max <= 0 || max > 1.f || min > max)
+        goto invalid_vcgt_tag;

[robert.bradford, 2017/04/04 13:54:24]

lgtm. But something has gone wrong with the identation here. Would be good to
fix before CQ.

[Noel Gordon, 2017/04/04 14:11:34]

Ah yes, my editor is in chromium mode, not qcms mode.  Let me fix.

 
                         for (j = 0; j < profile->vcgt.length; ++j) {
                                 *dest++ = 65535.f *
                                         (min + range * pow((float)j / (profile->vcgt.length - 1), gamma));
                         }
                 }
         }
 
         return true;
 
@@ skipping 190 matching lines @@
                         invalid_source(src, "unexpected type, expected XYZ");
                 num.X = read_s15Fixed16Number(src, offset+8);
                 num.Y = read_s15Fixed16Number(src, offset+12);
                 num.Z = read_s15Fixed16Number(src, offset+16);
         } else {
                 invalid_source(src, "missing xyztag");
         }
         return num;
 }
 
-// Read the tag at a given offset rather then the tag_index. 
+// Read the tag at a given offset rather then the tag_index.
 // This method is used when reading mAB tags where nested curveType are
 // present that are not part of the tag_index.
 static struct curveType *read_curveType(struct mem_source *src, uint32_t offset, uint32_t *len)
 {
         static const uint32_t COUNT_TO_LENGTH[5] = {1, 3, 4, 5, 7};
         struct curveType *curve = NULL;
         uint32_t type = read_u32(src, offset);
         uint32_t count;
         int i;
 
@@ skipping 30 matching lines @@
                 }
 
                 curve = malloc(sizeof(struct curveType));
                 if (!curve)
                         return NULL;
 
                 curve->count = count;
                 curve->type = type;
 
                 for (i=0; i < COUNT_TO_LENGTH[count]; i++) {
-                        curve->parameter[i] = s15Fixed16Number_to_float(read_s15Fixed16Number(src, offset + 12 + i*4)); 
+                        curve->parameter[i] = s15Fixed16Number_to_float(read_s15Fixed16Number(src, offset + 12 + i*4));

[robert.bradford, 2017/04/04 13:54:24]

I don't think you need this hunk.

[Noel Gordon, 2017/04/04 14:11:34]

Agree, my editor again, will fix.

                 }
                 *len = 12 + COUNT_TO_LENGTH[count] * 4;
 
                 if ((count == 1 || count == 2)) {
                         /* we have a type 1 or type 2 function that has a division by 'a' */
                         float a = curve->parameter[1];
                         if (a == 0.f)
                                 invalid_source(src, "parametricCurve definition causes division by zero.");
                 }
         }
@@ skipping 883 matching lines @@
 {
         qcms_profile *profile = NULL;
         FILE *file = _wfopen(path, L"rb");
         if (file) {
                 profile = qcms_profile_from_file(file);
                 fclose(file);
         }
         return profile;
 }
 #endif