[qcms] Only accept valid input ranges when reading VCGT formula

third_party/qcms/src/iccread.c

 /* vim: set ts=8 sw=8 noexpandtab: */
 //  qcms
 //  Copyright (C) 2009 Mozilla Foundation
 //  Copyright (C) 1998-2007 Marti Maria
 //
 // Permission is hereby granted, free of charge, to any person obtaining 
 // a copy of this software and associated documentation files (the "Software"), 
 // to deal in the Software without restriction, including without limitation 
 // the rights to use, copy, modify, merge, publish, distribute, sublicense, 
 // and/or sell copies of the Software, and to permit persons to whom the Software 
@@ skipping 461 matching lines @@
                         float gamma = s15Fixed16Number_to_float(
                                         read_s15Fixed16Number(src, formula_offset + 12 * i));
                         float min = s15Fixed16Number_to_float(
                                         read_s15Fixed16Number(src, formula_offset + 4 + 12 * i));
                         float max = s15Fixed16Number_to_float(
                                         read_s15Fixed16Number(src, formula_offset + 8 + 12 * i));
                         float range = max - min;
 
                         if (!src->valid)
                                 goto invalid_vcgt_tag;
+                        if (gamma <= 0)
+                                goto invalid_vcgt_tag;
+                        if (min <= 0 || min > 1.f)
+                                goto invalid_vcgt_tag;
+                        if (max <= 0 || max > 1.f || min > max)
+                                goto invalid_vcgt_tag;
 
                         for (j = 0; j < profile->vcgt.length; ++j) {
                                 *dest++ = 65535.f *
                                         (min + range * pow((float)j / (profile->vcgt.length - 1), gamma));
                         }
                 }
         }
 
         return true;
 
@@ skipping 1145 matching lines @@
 {
         qcms_profile *profile = NULL;
         FILE *file = _wfopen(path, L"rb");
         if (file) {
                 profile = qcms_profile_from_file(file);
                 fclose(file);
         }
         return profile;
 }
 #endif