summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorMarti Maria <info@littlecms.com>2017-03-20 17:12:15 +0100
committerMarti Maria <info@littlecms.com>2017-03-20 17:12:15 +0100
commitf9d75ccef0b54c9f4167d95088d4727985133c52 (patch)
tree90726e7f3a2c934a84d731c79147543719139479 /src
parent76d1dccf3e5ce0c67125964d0908b322e7d1afb9 (diff)
downloadlcms2-f9d75ccef0b54c9f4167d95088d4727985133c52.tar.gz
[oss-fuzz] Fix corrupted tag detection on MPE
Diffstat (limited to 'src')
-rw-r--r--src/cmsio0.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/src/cmsio0.c b/src/cmsio0.c
index eafd41d..af3249d 100644
--- a/src/cmsio0.c
+++ b/src/cmsio0.c
@@ -1541,6 +1541,8 @@ void* CMSEXPORT cmsReadTag(cmsHPROFILE hProfile, cmsTagSignature sig)
Offset = Icc -> TagOffsets[n];
TagSize = Icc -> TagSizes[n];
+ if (TagSize < 8) goto Error;
+
// Seek to its location
if (!io -> Seek(io, Offset))
goto Error;
@@ -1563,8 +1565,8 @@ void* CMSEXPORT cmsReadTag(cmsHPROFILE hProfile, cmsTagSignature sig)
if (BaseType == 0) goto Error;
if (!IsTypeSupported(TagDescriptor, BaseType)) goto Error;
-
- TagSize -= 8; // Alredy read by the type base logic
+
+ TagSize -= 8; // Alredy read by the type base logic
// Get type handler
TypeHandler = _cmsGetTagTypeHandler(Icc ->ContextID, BaseType);