commit 569770ec9110579036c29b2e82aa52df0aa59dc8
author Brian Osman <brianosman@google.com> Fri Feb 23 09:45:49 2018 -0500
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Fri Feb 23 14:53:52 2018 +0000
tree a8ce9d28b50af82d2c3bdb90de091b5e74f9bc6a
parent c5472f44e1a2c15eb60bc2fd4255c67b9004f11f

Avoid out-of-bounds access to grid_points

Bug: oss-fuzz:6521
Change-Id: I03ce010633ad340c0b5f78cc2f3f16ae199a9240
Reviewed-on: https://skia-review.googlesource.com/109800
Reviewed-by: Brian Osman <brianosman@google.com>
Commit-Queue: Brian Osman <brianosman@google.com>

profiles/fuzz/a2b_too_many_input_channels.icc

diff --git a/profiles/fuzz/a2b_too_many_input_channels.icc b/profiles/fuzz/a2b_too_many_input_channels.icc
new file mode 100644
index 0000000..506518d
--- /dev/null
+++ b/profiles/fuzz/a2b_too_many_input_channels.icc
Binary files differ

src/ICCProfile.c

diff --git a/src/ICCProfile.c b/src/ICCProfile.c
index f02e3de..2749064 100644
--- a/src/ICCProfile.c
+++ b/src/ICCProfile.c
@@ -393,9 +393,6 @@
     a2b->matrix_channels = 0;
 
     a2b->input_channels  = mftTag->input_channels[0];
-    for (uint32_t i = 0; i < a2b->input_channels; ++i) {
-        a2b->grid_points[i] = mftTag->grid_points[0];
-    }
     a2b->output_channels = mftTag->output_channels[0];
 
     // We require exactly three (ie XYZ/Lab/RGB) output channels
@@ -406,6 +403,10 @@
     if (a2b->input_channels < 1 || a2b->input_channels > ARRAY_COUNT(a2b->input_curves)) {
         return false;
     }
+
+    for (uint32_t i = 0; i < a2b->input_channels; ++i) {
+        a2b->grid_points[i] = mftTag->grid_points[0];
+    }
     // The grid only makes sense with at least two points along each axis
     if (a2b->grid_points[0] < 2) {
         return false;

tests.c

diff --git a/tests.c b/tests.c
index 103061d..0539c19 100644
--- a/tests.c
+++ b/tests.c
@@ -565,6 +565,7 @@
     { "profiles/fuzz/curv_size_overflow.icc",          true, NULL, NULL, NULL }, // skia:7593
     { "profiles/fuzz/truncated_curv_tag.icc",          true, NULL, NULL, NULL }, // oss-fuzz:6103
     { "profiles/fuzz/zero_a.icc",                      true, NULL, NULL, NULL }, // oss-fuzz:????
+    { "profiles/fuzz/a2b_too_many_input_channels.icc", true, NULL, NULL, NULL }, // oss-fuzz:6521
 };
 
 static void load_file(const char* filename, void** buf, size_t* len) {