commit f4145df3f36aeb10d78d6b4ba9f06ca2270e5e37
author Oliver Chang <ochang@chromium.org> Mon Nov 28 15:46:15 2016 -0800
committer Oliver Chang <ochang@chromium.org> Mon Nov 28 15:46:15 2016 -0800
tree 5727ca0848adf959cc5458f08226f3888cdc27fb
parent dad0707d0e7ea3f612dd14a5e35b5af163cedf82

M55: pdfium: Fix inconsistent number of color components of ICC profile

fx_codec_icc.cpp specify default number of color components as 3 for
unknown profiles. However, lcms may know such profile with different
number of components. The inconsistency may lead to array access
violation.

This CL uses cmsChannelsOf() from lcms to ensure consistency. And
rejects unexpected number according to PDF spec.

BUG=chromium:667694

Original-Review-Url: https://codereview.chromium.org/2522933002
(cherry picked from commit 89a2d92549d25df6786d53de5671eb141e1fd3e2)

TBR=thestig@chromium.org,tsepez@chromium.org

Review URL: https://codereview.chromium.org/2535663005 .

core/fxcodec/codec/fx_codec_icc.cpp

diff --git a/core/fxcodec/codec/fx_codec_icc.cpp b/core/fxcodec/codec/fx_codec_icc.cpp
index 8e48bfb..900faa1 100644
--- a/core/fxcodec/codec/fx_codec_icc.cpp
+++ b/core/fxcodec/codec/fx_codec_icc.cpp
@@ -8,12 +8,6 @@
 #include "core/fxcodec/fx_codec.h"
 #include "third_party/lcms2-2.6/include/lcms2.h"
 
-const uint32_t N_COMPONENT_LAB = 3;
-const uint32_t N_COMPONENT_GRAY = 1;
-const uint32_t N_COMPONENT_RGB = 3;
-const uint32_t N_COMPONENT_CMYK = 4;
-const uint32_t N_COMPONENT_DEFAULT = 3;
-
 struct CLcmsCmm {
   cmsHTRANSFORM m_hTransform;
   int m_nSrcComponents;
@@ -59,28 +53,6 @@
   return TRUE;
 }
 
-uint32_t GetCSComponents(cmsColorSpaceSignature cs) {
-  uint32_t components;
-  switch (cs) {
-    case cmsSigLabData:
-      components = N_COMPONENT_LAB;
-      break;
-    case cmsSigGrayData:
-      components = N_COMPONENT_GRAY;
-      break;
-    case cmsSigRgbData:
-      components = N_COMPONENT_RGB;
-      break;
-    case cmsSigCmykData:
-      components = N_COMPONENT_CMYK;
-      break;
-    default:
-      components = N_COMPONENT_DEFAULT;
-      break;
-  }
-  return components;
-}
-
 void* IccLib_CreateTransform(const unsigned char* pSrcProfileData,
                              uint32_t dwSrcProfileSize,
                              uint32_t& nSrcComponents,
@@ -110,7 +82,15 @@
   int srcFormat;
   FX_BOOL bLab = FALSE;
   cmsColorSpaceSignature srcCS = cmsGetColorSpace(srcProfile);
-  nSrcComponents = GetCSComponents(srcCS);
+
+  nSrcComponents = cmsChannelsOf(srcCS);
+  // According to PDF spec, number of components must be 1, 3, or 4.
+  if (nSrcComponents != 1 && nSrcComponents != 3 && nSrcComponents != 4) {
+    cmsCloseProfile(srcProfile);
+    cmsCloseProfile(dstProfile);
+    return nullptr;
+  }
+
   if (srcCS == cmsSigLabData) {
     srcFormat =
         COLORSPACE_SH(PT_Lab) | CHANNELS_SH(nSrcComponents) | BYTES_SH(0);