commit 62356867b331bc9f71f9a0c8fce0cff9927d3356
author kcwu <kcwu@chromium.org> Thu Sep 22 12:56:23 2016 -0700
committer Commit bot <commit-bot@chromium.org> Thu Sep 22 12:56:23 2016 -0700
tree 0b4ef2bdb6432efab31c61241a9553c320faee99
parent 869a4381b12dadfabe9750bd4d1a3867241917c8

Fix use uninitialized value and stack buffer overflow read

Found by libfuzzer

Review-Url: https://codereview.chromium.org/2362813002

third_party/lcms2-2.6/0003-uninit.patch

diff --git a/third_party/lcms2-2.6/0003-uninit.patch b/third_party/lcms2-2.6/0003-uninit.patch
new file mode 100644
index 0000000..476007e
--- /dev/null
+++ b/third_party/lcms2-2.6/0003-uninit.patch
@@ -0,0 +1,30 @@
+diff --git a/third_party/lcms2-2.6/src/cmstypes.c b/third_party/lcms2-2.6/src/cmstypes.c
+index 06742b5..44c5b87 100644
+--- a/third_party/lcms2-2.6/src/cmstypes.c
++++ b/third_party/lcms2-2.6/src/cmstypes.c
+@@ -2964,7 +2964,7 @@ void *Type_ColorantTable_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER
+ {
+     cmsUInt32Number i, Count;
+     cmsNAMEDCOLORLIST* List;
+-    char Name[34];
++    char Name[33];
+     cmsUInt16Number PCS[3];
+ 
+ 
+@@ -2979,7 +2979,7 @@ void *Type_ColorantTable_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER
+     for (i=0; i < Count; i++) {
+ 
+         if (io ->Read(io, Name, 32, 1) != 1) goto Error;
+-        Name[33] = 0;
++        Name[32] = 0;
+ 
+         if (!_cmsReadUInt16Array(io, 3, PCS)) goto Error;
+ 
+@@ -3106,6 +3106,7 @@ void *Type_NamedColor_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* i
+ 
+         memset(Colorant, 0, sizeof(Colorant));
+         if (io -> Read(io, Root, 32, 1) != 1) return NULL;
++        Root[32] = 0;
+         if (!_cmsReadUInt16Array(io, 3, PCS)) goto Error;
+         if (!_cmsReadUInt16Array(io, nDeviceCoords, Colorant)) goto Error;
+ 

third_party/lcms2-2.6/README.pdfium

diff --git a/third_party/lcms2-2.6/README.pdfium b/third_party/lcms2-2.6/README.pdfium
index c15b2b1..82bdbc6 100644
--- a/third_party/lcms2-2.6/README.pdfium
+++ b/third_party/lcms2-2.6/README.pdfium
@@ -12,4 +12,5 @@
 0000-tag-type-confusion.patch: Fix a type confusion.
 0001-from16-to-8-overflow.patch: Prevent a UBSan warning.
 0002-infinite-loop-GrowNamedColorList.patch: Fix infinite loop when calling GrowNamedColorList.
+0003-uninit.patch: Fix use uninitialized value and stack buffer overflow read.
 TODO(ochang): List other patches.

third_party/lcms2-2.6/src/cmstypes.c

diff --git a/third_party/lcms2-2.6/src/cmstypes.c b/third_party/lcms2-2.6/src/cmstypes.c
index 06742b5..44c5b87 100644
--- a/third_party/lcms2-2.6/src/cmstypes.c
+++ b/third_party/lcms2-2.6/src/cmstypes.c
@@ -2964,7 +2964,7 @@
 {
     cmsUInt32Number i, Count;
     cmsNAMEDCOLORLIST* List;
-    char Name[34];
+    char Name[33];
     cmsUInt16Number PCS[3];
 
 
@@ -2979,7 +2979,7 @@
     for (i=0; i < Count; i++) {
 
         if (io ->Read(io, Name, 32, 1) != 1) goto Error;
-        Name[33] = 0;
+        Name[32] = 0;
 
         if (!_cmsReadUInt16Array(io, 3, PCS)) goto Error;
 
@@ -3106,6 +3106,7 @@
 
         memset(Colorant, 0, sizeof(Colorant));
         if (io -> Read(io, Root, 32, 1) != 1) return NULL;
+        Root[32] = 0;
         if (!_cmsReadUInt16Array(io, 3, PCS)) goto Error;
         if (!_cmsReadUInt16Array(io, nDeviceCoords, Colorant)) goto Error;