Check for unused tag_len in read_nested_curveType()

third_party/qcms/src/iccread.c

 /* vim: set ts=8 sw=8 noexpandtab: */
 //  qcms
 //  Copyright (C) 2009 Mozilla Foundation
 //  Copyright (C) 1998-2007 Marti Maria
 //
 // Permission is hereby granted, free of charge, to any person obtaining 
 // a copy of this software and associated documentation files (the "Software"), 
 // to deal in the Software without restriction, including without limitation 
 // the rights to use, copy, modify, merge, publish, distribute, sublicense, 
 // and/or sell copies of the Software, and to permit persons to whom the Software 
@@ skipping 475 matching lines @@
         return curve;
 }
 
 #define MAX_CLUT_SIZE 500000 // arbitrary
 #define MAX_CHANNELS 10 // arbitrary
 static void read_nested_curveType(struct mem_source *src, struct curveType *(*curveArray)[MAX_CHANNELS], uint8_t num_channels, uint32_t curve_offset)
 {
         uint32_t channel_offset = 0;
         int i;
         for (i = 0; i < num_channels; i++) {
-                uint32_t tag_len;
+                uint32_t tag_len = ~0;
 
                 (*curveArray)[i] = read_curveType(src, curve_offset + channel_offset, &tag_len);
                 if (!(*curveArray)[i]) {
                         invalid_source(src, "invalid nested curveType curve");
                 }
 
+                if (tag_len == ~0) {
+                        invalid_source(src, "invalid nested curveType tag length");
+                        return;
+                }
+
                 channel_offset += tag_len;
                 // 4 byte aligned
                 if ((tag_len % 4) != 0)
                         channel_offset += 4 - (tag_len % 4);
         }
-
 }
 
 static void mAB_release(struct lutmABType *lut)
 {
         uint8_t i;
 
         for (i = 0; i < lut->num_in_channels; i++){
                 free(lut->a_curves[i]);
         }
         for (i = 0; i < lut->num_out_channels; i++){
@@ skipping 688 matching lines @@
 {
         qcms_profile *profile = NULL;
         FILE *file = _wfopen(path, L"rb");
         if (file) {
                 profile = qcms_profile_from_file(file);
                 fclose(file);
         }
         return profile;
 }
 #endif