diff options
| author | Marti Maria <marti.maria@littlecms.com> | 2023-04-18 09:12:29 +0200 |
|---|---|---|
| committer | Marti Maria <marti.maria@littlecms.com> | 2023-04-18 09:12:29 +0200 |
| commit | c61a2c798e0f3ca73d2f78e8721ae37e6a70c045 (patch) | |
| tree | 1e0b480edd5ab25ffd6637cb829c7d6a30729325 | |
| parent | 5b083856e928bd73a655c1d6c1255c49d973ceca (diff) | |
| download | lcms2-c61a2c798e0f3ca73d2f78e8721ae37e6a70c045.tar.gz | |
Sanitize number of channels in profile elements
Prevent profiles claiming a wrong number of channels
| -rw-r--r-- | src/cmstypes.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/cmstypes.c b/src/cmstypes.c index ec1909f..17eb7d9 100644 --- a/src/cmstypes.c +++ b/src/cmstypes.c @@ -4430,8 +4430,8 @@ void *Type_MPEclut_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* io, if (!_cmsReadUInt16Number(io, &InputChans)) return NULL; if (!_cmsReadUInt16Number(io, &OutputChans)) return NULL; - if (InputChans == 0) goto Error; - if (OutputChans == 0) goto Error; + if (InputChans == 0 || InputChans >= cmsMAXCHANNELS) goto Error; + if (OutputChans == 0 || OutputChans >= cmsMAXCHANNELS) goto Error; if (io ->Read(io, Dimensions8, sizeof(cmsUInt8Number), 16) != 16) goto Error; |