commit 869a4381b12dadfabe9750bd4d1a3867241917c8
author kcwu <kcwu@chromium.org> Thu Sep 22 11:45:50 2016 -0700
committer Commit bot <commit-bot@chromium.org> Thu Sep 22 11:45:50 2016 -0700
tree 4570d85e433337653766287d8b96f8e3e5c33f9b
parent fef62e1f2bbf064100e6e262a10653f2374bfd2b

Fix infinite loop when calling GrowNamedColorList

Handle the case that GrowNamedColorList return fail when list is too
long. Otherwise the loop never ends.

Found by libfuzzer

Review-Url: https://codereview.chromium.org/2365663002

third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch

diff --git a/third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch b/third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch
new file mode 100644
index 0000000..9c01a51
--- /dev/null
+++ b/third_party/lcms2-2.6/0002-infinite-loop-GrowNamedColorList.patch
@@ -0,0 +1,34 @@
+diff --git a/third_party/lcms2-2.6/src/cmsnamed.c b/third_party/lcms2-2.6/src/cmsnamed.c
+index acfd1c8..ef1eb30 100644
+--- a/third_party/lcms2-2.6/src/cmsnamed.c
++++ b/third_party/lcms2-2.6/src/cmsnamed.c
+@@ -514,8 +514,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsAllocNamedColorList(cmsContext ContextID, cmsUIn
+     v ->nColors   = 0;
+     v ->ContextID  = ContextID;
+ 
+-    while (v -> Allocated < n)
+-        GrowNamedColorList(v);
++    while (v -> Allocated < n) {
++        if (!GrowNamedColorList(v)) {
++            cmsFreeNamedColorList(v);
++            return NULL;
++        }
++    }
+ 
+     strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix)-1);
+     strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix)-1);
+@@ -544,8 +548,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsDupNamedColorList(const cmsNAMEDCOLORLIST* v)
+     if (NewNC == NULL) return NULL;
+ 
+     // For really large tables we need this
+-    while (NewNC ->Allocated < v ->Allocated)
+-        GrowNamedColorList(NewNC);
++    while (NewNC ->Allocated < v ->Allocated) {
++        if (!GrowNamedColorList(NewNC)) {
++            cmsFreeNamedColorList(NewNC);
++            return NULL;
++        }
++    }
+ 
+     memmove(NewNC ->Prefix, v ->Prefix, sizeof(v ->Prefix));
+     memmove(NewNC ->Suffix, v ->Suffix, sizeof(v ->Suffix));

third_party/lcms2-2.6/README.pdfium

diff --git a/third_party/lcms2-2.6/README.pdfium b/third_party/lcms2-2.6/README.pdfium
index 6c3d5dd..c15b2b1 100644
--- a/third_party/lcms2-2.6/README.pdfium
+++ b/third_party/lcms2-2.6/README.pdfium
@@ -11,4 +11,5 @@
 
 0000-tag-type-confusion.patch: Fix a type confusion.
 0001-from16-to-8-overflow.patch: Prevent a UBSan warning.
+0002-infinite-loop-GrowNamedColorList.patch: Fix infinite loop when calling GrowNamedColorList.
 TODO(ochang): List other patches.

third_party/lcms2-2.6/src/cmsnamed.c

diff --git a/third_party/lcms2-2.6/src/cmsnamed.c b/third_party/lcms2-2.6/src/cmsnamed.c
index acfd1c8..ef1eb30 100644
--- a/third_party/lcms2-2.6/src/cmsnamed.c
+++ b/third_party/lcms2-2.6/src/cmsnamed.c
@@ -514,8 +514,12 @@
     v ->nColors   = 0;
     v ->ContextID  = ContextID;
 
-    while (v -> Allocated < n)
-        GrowNamedColorList(v);
+    while (v -> Allocated < n) {
+        if (!GrowNamedColorList(v)) {
+            cmsFreeNamedColorList(v);
+            return NULL;
+        }
+    }
 
     strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix)-1);
     strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix)-1);
@@ -544,8 +548,12 @@
     if (NewNC == NULL) return NULL;
 
     // For really large tables we need this
-    while (NewNC ->Allocated < v ->Allocated)
-        GrowNamedColorList(NewNC);
+    while (NewNC ->Allocated < v ->Allocated) {
+        if (!GrowNamedColorList(NewNC)) {
+            cmsFreeNamedColorList(NewNC);
+            return NULL;
+        }
+    }
 
     memmove(NewNC ->Prefix, v ->Prefix, sizeof(v ->Prefix));
     memmove(NewNC ->Suffix, v ->Suffix, sizeof(v ->Suffix));