check we've fit an sRGB-ish TF

Bug: oss-fuzz:18249
Change-Id: I2e4079945c2e9c94759729cfd83294ba34275159
Reviewed-on: https://skia-review.googlesource.com/c/skcms/+/248839
Reviewed-by: Brian Osman <brianosman@google.com>
Commit-Queue: Mike Klein <mtklein@google.com>
diff --git a/profiles/fuzz/fit_pq.icc b/profiles/fuzz/fit_pq.icc
new file mode 100644
index 0000000..b51dc80
--- /dev/null
+++ b/profiles/fuzz/fit_pq.icc
Binary files differ
diff --git a/profiles/fuzz/fit_pq.icc.txt b/profiles/fuzz/fit_pq.icc.txt
new file mode 100644
index 0000000..93a0b93
--- /dev/null
+++ b/profiles/fuzz/fit_pq.icc.txt
@@ -0,0 +1,38 @@
+                Size : 0x00000090 : 144
+    Data color space : 0x47524159 : 'GRAY'
+                 PCS : 0x58595A20 : 'XYZ '
+           Tag count : 0x00000001 : 1
+
+ Tag    : Type   : Size   : Offset
+ ------ : ------ : ------ : --------
+ 'kTRC' : 'curv' :    110 : 32
+
+rTRC : 16-bit table with 5 entries
+gTRC : 16-bit table with 5 entries
+bTRC : 16-bit table with 5 entries
+ XYZ : | 0.95799255 0 0 |
+       | 0 1.0027313 0 |
+       | 0 0 0.81640625 |
+252 random bytes transformed to linear XYZD50 bytes:
+	00cf02 f4ff00 19e300 000023 000088 f40000 00ff00
+	f4000f 000000 f40000 f4ff00 66b700 007f00 6200d0
+	f4cbd0 00d7d0 f3ff6a 00a300 0e00ac f48f00 f400d0
+	f40000 000050 f4ff8e f400d0 beff00 0000d0 00ff46
+	6a4b00 43004d 00007b f4ff77 25ffb2 f400d0 00ff00
+	4bffd0 008b00 f40000 00ff00 000000 0000d0 000091
+	0000d0 060000 00efd0 000000 004300 f40000 f433d0
+	f4ff7e f42fd0 f40000 00ff00 00ff19 000000 00ff00
+	00ff00 f45300 000000 750000 000033 000000 ba0000
+	d573d0 ec00c6 00fb00 f400bf 810000 00018b 16bbd0
+	007700 0000d0 00002c f40000 00ff00 000000 009fd0
+	00ff00 dc0009 005b30 f40000 00ff1c f40000 00bfd0
+81 edge-case pixels transformed to sRGB 8888 (unpremul):
+	00000000 00000012 004a00ff  00000c00 00000609 004a00ff  0000ff00 0000ff00 0000fdff
+	00080000 00080010 004b00ff  00060d00 00060706 004b00ff  0000ff00 0000ff00 0000fdff
+	00ff2e00 00ff2c00 00ff00ff  00ff3100 00ff3000 00ff00ff  00f6ff00 00f6ff00 00fefffd
+	7f000000 7f000012 7f4a00ff  7f000c00 7f000609 7f4a00ff  7f00ff00 7f00ff00 7f00fdff
+	7f080000 7f080010 7f4b00ff  7f060d00 7f060706 7f4b00ff  7f00ff00 7f00ff00 7f00fdff
+	7fff2e00 7fff2c00 7fff00ff  7fff3100 7fff3000 7fff00ff  7ff6ff00 7ff6ff00 7ffefffd
+	ff000000 ff000012 ff4a00ff  ff000c00 ff000609 ff4a00ff  ff00ff00 ff00ff00 ff00fdff
+	ff080000 ff080010 ff4b00ff  ff060d00 ff060706 ff4b00ff  ff00ff00 ff00ff00 ff00fdff
+	ffff2e00 ffff2c00 ffff00ff  ffff3100 ffff3000 ffff00ff  fff6ff00 fff6ff00 fffefffd
diff --git a/skcms.cc b/skcms.cc
index bace176..6b4d87b 100644
--- a/skcms.cc
+++ b/skcms.cc
@@ -1872,6 +1872,13 @@
             }
         }
 
+        // We'd better have a sane, sRGB-ish TF by now.
+        // Other non-Bad TFs would be fine, but we know we've only ever tried to fit sRGBish;
+        // anything else is just some accident of math and the way we pun tf.g as a type flag.
+        if (sRGBish != classify(tf)) {
+            continue;
+        }
+
         // We find our error by roundtripping the table through tf_inv.
         //
         // (The most likely use case for this approximation is to be inverted and
diff --git a/tests.c b/tests.c
index c72fa70..6609b4b 100644
--- a/tests.c
+++ b/tests.c
@@ -689,6 +689,8 @@
 
     "profiles/fuzz/nan_s.icc",                        // oss-fuzz:16674
     "profiles/fuzz/inf_a.icc",                        // oss-fuzz:16675
+
+    "profiles/fuzz/fit_pq.icc",                       // oss-fuzz:18249
 };
 
 static void test_Parse(bool regen) {