[skcms] Fix crash by reading before CLUT

skcms uses an optimization for gather_24 and gather_48 to load 4 or 8
bytes and then throw away a junk byte (instead of individually doing 3
loads, one for r, one for g, one for b). It did this before (added in
[1]) by subtracting of 1 or 2 from the pointer

This was thought to be safe since there should only be data before this
table that is also in the ICC profile (and not an OOB read), however,
due to the use of moxcms to parse ICC profiles, the CLUT table can be
in its own buffer (e.g. at the beginning of a memory page) and thus we
don't have any of the padding we expect before or after it.

Instead, we can still have similar performance (and actually save a
subtraction op per read) by just reading 4 or 8 bytes at the beginning
of the CLUT and then masking off the junk byte (which might *not*
actually be needed anyway since the callers extract just the r, g, b
values they need).

This can now walk off the end of the buffer but there should be padding [2] [3]

[1] https://review.skia.org/116740
[2] https://www.color.org/specification/ICC.1-2022-05.pdf
[3] https://review.skia.org/1205176

Bug: b/498869813
Bug: b/498927031
Change-Id: I88445d9be9e899e670f2cf9d55e0d2f79446f535
Reviewed-on: https://skia-review.googlesource.com/c/skcms/+/1201671
Commit-Queue: Kaylee Lubick <kjlubick@google.com>
Reviewed-by: Florin Malita <fmalita@google.com>
2 files changed
tree: f269c28fc565be7c1bc9fb2450d0a5e437d2086d
  1. bazel/
  2. fuzz/
  3. infra/
  4. ninja/
  5. profiles/
  6. src/
  7. toolchain/
  8. .bazelrc
  9. .bazelversion
  10. .gitignore
  11. BAZEL.md
  12. bench.c
  13. BUILD.bazel
  14. build.ninja
  15. codereview.settings
  16. iccdump.c
  17. LICENSE
  18. MODULE.bazel
  19. MODULE.bazel.lock
  20. msvs.ninja
  21. OWNERS
  22. README.chromium
  23. README.md
  24. skcms.cc
  25. skcms.gni
  26. skcms.h
  27. test_only.c
  28. test_only.h
  29. tests.c
  30. whitespace.txt
README.md

To build with ninja, simply run ninja from the root directory. This will produce a library in /out.

There are also Bazel rules, outlined in BAZEL.md