fix fuzzer bug

I mistakenly rewrote read_mft_common() to trust input_channels before
testing it's in safe range.  This CL restores the original order.

out/clang.xsan/fuzz_iccprofile_atf and the new test case repro'd this.

It looks like this might fix attached both issues, but I haven't looked
as hard at 32767 or repro'd it with MSAN.

Bug: oss-fuzz:32765, oss-fuzz:32767
Change-Id: I6f546ec304e6fe6fcf7f60872161e5ad9ca10e43
Reviewed-on: https://skia-review.googlesource.com/c/skcms/+/391797
Commit-Queue: Brian Osman <brianosman@google.com>
Auto-Submit: Mike Klein <mtklein@google.com>
Reviewed-by: Brian Osman <brianosman@google.com>
diff --git a/profiles/fuzz/a2b_too_many_input_channels2.icc b/profiles/fuzz/a2b_too_many_input_channels2.icc
new file mode 100644
index 0000000..9b8a2ce
--- /dev/null
+++ b/profiles/fuzz/a2b_too_many_input_channels2.icc
Binary files differ
diff --git a/profiles/fuzz/a2b_too_many_input_channels2.icc.txt b/profiles/fuzz/a2b_too_many_input_channels2.icc.txt
new file mode 100644
index 0000000..979baac
--- /dev/null
+++ b/profiles/fuzz/a2b_too_many_input_channels2.icc.txt
@@ -0,0 +1 @@
+Unable to parse ICC profile
diff --git a/skcms.cc b/skcms.cc
index aabe489..710f598 100644
--- a/skcms.cc
+++ b/skcms.cc
@@ -606,18 +606,9 @@
     // matrix in skcms_A2B is applied later in the pipe, so supporting this would require another
     // field/flag.
     a2b->matrix_channels = 0;
-
     a2b-> input_channels = mftTag-> input_channels[0];
     a2b->output_channels = mftTag->output_channels[0];
 
-    for (uint32_t i = 0; i < a2b->input_channels; ++i) {
-        a2b->grid_points[i] = mftTag->grid_points[0];
-    }
-    // The grid only makes sense with at least two points along each axis
-    if (a2b->grid_points[0] < 2) {
-        return false;
-    }
-
     // We require exactly three (ie XYZ/Lab/RGB) output channels
     if (a2b->output_channels != ARRAY_COUNT(a2b->output_curves)) {
         return false;
@@ -627,25 +618,25 @@
         return false;
     }
 
+    for (uint32_t i = 0; i < a2b->input_channels; ++i) {
+        a2b->grid_points[i] = mftTag->grid_points[0];
+    }
+    // The grid only makes sense with at least two points along each axis
+    if (a2b->grid_points[0] < 2) {
+        return false;
+    }
     return true;
 }
 
 // All as the A2B version above, except where noted.
 static bool read_mft_common(const mft_CommonLayout* mftTag, skcms_B2A* b2a) {
-    // All the same as A2B until the next comment...
+    // Same as A2B.
     b2a->matrix_channels = 0;
-
     b2a-> input_channels = mftTag-> input_channels[0];
     b2a->output_channels = mftTag->output_channels[0];
 
-    for (uint32_t i = 0; i < b2a->input_channels; ++i) {
-        b2a->grid_points[i] = mftTag->grid_points[0];
-    }
-    if (b2a->grid_points[0] < 2) {
-        return false;
-    }
 
-    // ...for B2A, exactly 3 *input* channels and 1-4 *output* channels.
+    // For B2A, exactly 3 *input* channels and 1-4 *output* channels.
     if (b2a->input_channels != ARRAY_COUNT(b2a->input_curves)) {
         return false;
     }
@@ -653,6 +644,13 @@
         return false;
     }
 
+    // Same as A2B.
+    for (uint32_t i = 0; i < b2a->input_channels; ++i) {
+        b2a->grid_points[i] = mftTag->grid_points[0];
+    }
+    if (b2a->grid_points[0] < 2) {
+        return false;
+    }
     return true;
 }
 
diff --git a/tests.c b/tests.c
index 76fde3d..401777c 100644
--- a/tests.c
+++ b/tests.c
@@ -647,6 +647,7 @@
     "profiles/fuzz/truncated_curv_tag.icc",           // oss-fuzz:6103
     "profiles/fuzz/zero_a.icc",                       // oss-fuzz:????
     "profiles/fuzz/a2b_too_many_input_channels.icc",  // oss-fuzz:6521
+    "profiles/fuzz/a2b_too_many_input_channels2.icc", // oss-fuzz:32765
     "profiles/fuzz/mangled_trc_tags.icc",             // chromium:835666
     "profiles/fuzz/negative_g_para.icc",              // chromium:836634