[gs-cvs] rev 8722 - trunk/gs/icclib

[alexcher at ghostscript.com]

Author: alexcher
Date: 2008-05-08 21:12:01 -0700 (Thu, 08 May 2008)
New Revision: 8722

Modified:
   trunk/gs/icclib/icc.c
Log:
Reject incorrect ICC profile that has 0 offset in one of the tags
and use alternate color space. Bug 689830.

DIFFERENCES:
None


Modified: trunk/gs/icclib/icc.c
===================================================================
--- trunk/gs/icclib/icc.c	2008-05-09 02:18:14 UTC (rev 8721)
+++ trunk/gs/icclib/icc.c	2008-05-09 04:12:01 UTC (rev 8722)
@@ -9273,6 +9273,13 @@
 		for (i = 0; i < p->count; i++, bp += 12) {
 	    	p->data[i].sig = (icTagSignature)read_SInt32Number(bp + 0);	
 	    	p->data[i].offset = read_UInt32Number(bp + 4);
+	    	if (p->data[i].offset < 128) { /* to catch 0 offset */
+	    	    sprintf(p->err, "icc_read: Impossible offset %u in tag %d", p->data[i].offset, i);
+	    	    p->al->free(p->al, p->data);
+	    	    p->data = NULL;
+	    	    p->al->free(p->al, buf);
+	    	    return p->errc = 1;
+	    	}
 	    	p->data[i].size = read_UInt32Number(bp + 8);	
 			if (   p->fp->seek(p->fp, of + p->data[i].offset) != 0
 			    || p->fp->read(p->fp, tcbuf, 1, 4) != 4) {
@@ -9915,18 +9922,20 @@
 	if (p->header != NULL)
 		(p->header->del)(p->header);
 
-	/* Free up the tag data objects */
-	for (i = 0; i < p->count; i++) {
-		if (p->data[i].objp != NULL) {
-			if (--(p->data[i].objp->refcount) == 0)	/* decrement reference count */
-				(p->data[i].objp->del)(p->data[i].objp);	/* Last reference */
-	  	  	p->data[i].objp = NULL;
-		}
+	if (p->data != NULL) {
+	    /* Free up the tag data objects */
+	    for (i = 0; i < p->count; i++) {
+		    if (p->data[i].objp != NULL) {
+			    if (--(p->data[i].objp->refcount) == 0)	/* decrement reference count */
+				    (p->data[i].objp->del)(p->data[i].objp);	/* Last reference */
+	  	  	    p->data[i].objp = NULL;
+		    }
+	    }
+
+	    /* Free tag table */
+	    al->free(al, p->data);
 	}
 
-	/* Free tag table */
-	al->free(al, p->data);
-
 	/* This object */
 	al->free(al, p);