1 diff --git a/third_party/lcms/src/cmsintrp.c b/third_party/lcms/src/cmsintrp.c 2 index 5d5f35d..14c6856 100644 3 --- a/third_party/lcms/src/cmsintrp.c 4 +++ b/third_party/lcms/src/cmsintrp.c 5 @@ -215,7 +215,7 @@ void LinLerp1D(register const cmsUInt16Number Value[], 6 // To prevent out of bounds indexing 7 cmsINLINE cmsFloat32Number fclamp(cmsFloat32Number v) 8 { 9 - return v < 0.0f ? 0.0f : (v > 1.0f ? 1.0f : v); 10 + return ((v < 0.0f) || isnan(v)) ? 0.0f : (v > 1.0f ? 1.0f : v); 11 } 12 13 // Floating-point version of 1D interpolation 14 diff --git a/third_party/lcms/src/cmsio0.c b/third_party/lcms/src/cmsio0.c 15 index 5f9f08a..3ed730a 100644 16 --- a/third_party/lcms/src/cmsio0.c 17 +++ b/third_party/lcms/src/cmsio0.c 18 @@ -1475,6 +1475,17 @@ void* CMSEXPORT cmsReadTag(cmsHPROFILE hProfile, cmsTagSignature sig) 19 // If the element is already in memory, return the pointer 20 if (Icc -> TagPtrs[n]) { 21 22 + if (Icc->TagTypeHandlers[n] == NULL) goto Error; 23 + 24 + // Sanity check 25 + BaseType = Icc->TagTypeHandlers[n]->Signature; 26 + if (BaseType == 0) goto Error; 27 + 28 + TagDescriptor = _cmsGetTagDescriptor(Icc->ContextID, sig); 29 + if (TagDescriptor == NULL) goto Error; 30 + 31 + if (!IsTypeSupported(TagDescriptor, BaseType)) goto Error; 32 + 33 if (Icc ->TagSaveAsRaw[n]) goto Error; // We don't support read raw tags as cooked 34 35 _cmsUnlockMutex(Icc->ContextID, Icc ->UsrMutex); 36 diff --git a/third_party/lcms/src/cmstypes.c b/third_party/lcms/src/cmstypes.c 37 index 04dd0c4..386439b 100644 38 --- a/third_party/lcms/src/cmstypes.c 39 +++ b/third_party/lcms/src/cmstypes.c 40 @@ -4297,8 +4297,12 @@ void *Type_MPEclut_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* io, 41 42 // Copy MAX_INPUT_DIMENSIONS at most. Expand to cmsUInt32Number 43 nMaxGrids = InputChans > MAX_INPUT_DIMENSIONS ? MAX_INPUT_DIMENSIONS : InputChans; 44 - for (i=0; i < nMaxGrids; i++) GridPoints[i] = (cmsUInt32Number) Dimensions8[i]; 45 46 + for (i = 0; i < nMaxGrids; i++) { 47 + if (Dimensions8[i] == 1) goto Error; // Impossible value, 0 for no CLUT and then 2 at least 48 + GridPoints[i] = (cmsUInt32Number)Dimensions8[i]; 49 + } 50 + 51 // Allocate the true CLUT 52 mpe = cmsStageAllocCLutFloatGranular(self ->ContextID, GridPoints, InputChans, OutputChans, NULL); 53 if (mpe == NULL) goto Error; 54
