stan/jdk-24
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

6899653: Sun Java Runtime CMM readMabCurveData Buffer Overflow Vulnerability

Browse Source 
Reviewed-by: prr, hawtin
This commit is contained in:
Andrew Brygin 2010-02-19 22:30:52 +03:00
parent 5a001b5a18
commit 2597796924
2 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
jdk/src/share/native/sun/java2d/cmm/lcms/cmsio1.c
View File

@ -1433,6 +1433,9 @@ LPLUT LCMSEXPORT cmsReadICCLut(cmsHPROFILE hProfile, icTagSignature sig)
// If is in memory, the LUT is already there, so throw a copy
if (Icc -> TagPtrs[n]) {
if (!_cmsValidateLUT((LPLUT) Icc ->TagPtrs[n])) {
return NULL;
}
return cmsDupLUT((LPLUT) Icc ->TagPtrs[n]);
}

4
jdk/src/share/native/sun/java2d/cmm/lcms/cmsxform.c
View File

@ -1969,6 +1969,10 @@ cmsHTRANSFORM LCMSEXPORT cmsCreateMultiprofileTransform(cmsHPROFILE hProfiles[],
goto ErrorCleanup;
}
if (Transforms[i] == NULL) {
cmsSignalError(LCMS_ERRC_ABORTED, "cmsCreateMultiprofileTransform: unable to create transform");
goto ErrorCleanup;
}
CurrentColorSpace = ColorSpaceOut;
}