1 diff --git a/third_party/lcms/src/cmscgats.c b/third_party/lcms/src/cmscgats.c 2 index 5720c66a7..cce4cedba 100644 3 --- a/third_party/lcms/src/cmscgats.c 4 +++ b/third_party/lcms/src/cmscgats.c 5 @@ -150,23 +150,24 @@ typedef struct { 6 SUBALLOCATOR Allocator; // String suballocator -- just to keep it fast 7 8 // Parser state machine 9 - SYMBOL sy; // Current symbol 10 - int ch; // Current character 11 + SYMBOL sy; // Current symbol 12 + int ch; // Current character 13 + 14 + cmsInt32Number inum; // integer value 15 + cmsFloat64Number dnum; // real value 16 17 - int inum; // integer value 18 - cmsFloat64Number dnum; // real value 19 char id[MAXID]; // identifier 20 char str[MAXSTR]; // string 21 22 // Allowed keywords & datasets. They have visibility on whole stream 23 - KEYVALUE* ValidKeywords; 24 - KEYVALUE* ValidSampleID; 25 + KEYVALUE* ValidKeywords; 26 + KEYVALUE* ValidSampleID; 27 28 char* Source; // Points to loc. being parsed 29 - int lineno; // line counter for error reporting 30 + cmsInt32Number lineno; // line counter for error reporting 31 32 FILECTX* FileStack[MAXINCLUDE]; // Stack of files being parsed 33 - int IncludeSP; // Include Stack Pointer 34 + cmsInt32Number IncludeSP; // Include Stack Pointer 35 36 char* MemoryBlock; // The stream if holded in memory 37 38 @@ -568,8 +569,8 @@ void ReadReal(cmsIT8* it8, int inum) 39 // Exponent, example 34.00E+20 40 if (toupper(it8->ch) == 'E') { 41 42 - int e; 43 - int sgn; 44 + cmsInt32Number e; 45 + cmsInt32Number sgn; 46 47 NextCh(it8); sgn = 1; 48 49 @@ -587,7 +588,7 @@ void ReadReal(cmsIT8* it8, int inum) 50 e = 0; 51 while (isdigit(it8->ch)) { 52 53 - if ((cmsFloat64Number) e * 10L < INT_MAX) 54 + if ((cmsFloat64Number) e * 10L < (cmsFloat64Number) +2147483647.0) 55 e = e * 10 + (it8->ch - '0'); 56 57 NextCh(it8); 58 @@ -777,7 +778,7 @@ void InSymbol(cmsIT8* it8) 59 60 while (isdigit(it8->ch)) { 61 62 - if ((long) it8->inum * 10L > (long) INT_MAX) { 63 + if ((cmsFloat64Number) it8->inum * 10L > (cmsFloat64Number) +2147483647.0) { 64 ReadReal(it8, it8->inum); 65 it8->sy = SDNUM; 66 it8->dnum *= sign; 67 diff --git a/third_party/lcms/src/cmstypes.c b/third_party/lcms/src/cmstypes.c 68 index 0256e247b..75f1fae32 100644 69 --- a/third_party/lcms/src/cmstypes.c 70 +++ b/third_party/lcms/src/cmstypes.c 71 @@ -4199,9 +4199,13 @@ void *Type_MPEmatrix_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* io 72 if (!_cmsReadUInt16Number(io, &OutputChans)) return NULL; 73 74 75 + // Input and output chans may be ANY (up to 0xffff), 76 + // but we choose to limit to 16 channels for now 77 + if (InputChans >= cmsMAXCHANNELS) return NULL; 78 + if (OutputChans >= cmsMAXCHANNELS) return NULL; 79 + 80 nElems = InputChans * OutputChans; 81 82 - // Input and output chans may be ANY (up to 0xffff) 83 Matrix = (cmsFloat64Number*) _cmsCalloc(self ->ContextID, nElems, sizeof(cmsFloat64Number)); 84 if (Matrix == NULL) return NULL; 85 86
