)]}'
{
  "commit": "15db2430b6288ac0a6b23e3f6a163fa016a3fab1",
  "tree": "f269c28fc565be7c1bc9fb2450d0a5e437d2086d",
  "parents": [
    "92c79500bad23ddf2983ae436470eba0134301cb"
  ],
  "author": {
    "name": "Kaylee Lubick",
    "email": "kjlubick@google.com",
    "time": "Fri Apr 03 16:34:27 2026 +0000"
  },
  "committer": {
    "name": "SkCQ",
    "email": "skcq-be@skia-corp.google.com.iam.gserviceaccount.com",
    "time": "Wed Apr 08 10:16:40 2026 -0700"
  },
  "message": "[skcms] Fix crash by reading before CLUT\n\nskcms uses an optimization for gather_24 and gather_48 to load 4 or 8\nbytes and then throw away a junk byte (instead of individually doing 3\nloads, one for r, one for g, one for b). It did this before (added in\n[1]) by subtracting of 1 or 2 from the pointer\n\nThis was thought to be safe since there should only be data before this\ntable that is also in the ICC profile (and not an OOB read), however,\ndue to the use of moxcms to parse ICC profiles, the CLUT table can be\nin its own buffer (e.g. at the beginning of a memory page) and thus we\ndon\u0027t have any of the padding we expect before or after it.\n\nInstead, we can still have similar performance (and actually save a\nsubtraction op per read) by just reading 4 or 8 bytes at the beginning\nof the CLUT and then masking off the junk byte (which might *not*\nactually be needed anyway since the callers extract just the r, g, b\nvalues they need).\n\nThis can now walk off the end of the buffer but there should be padding [2] [3]\n\n[1] https://review.skia.org/116740\n[2] https://www.color.org/specification/ICC.1-2022-05.pdf\n[3] https://review.skia.org/1205176\n\nBug: b/498869813\nBug: b/498927031\nChange-Id: I88445d9be9e899e670f2cf9d55e0d2f79446f535\nReviewed-on: https://skia-review.googlesource.com/c/skcms/+/1201671\nCommit-Queue: Kaylee Lubick \u003ckjlubick@google.com\u003e\nReviewed-by: Florin Malita \u003cfmalita@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "0d48337bfc1c452fee07ab80b6817e6f9fce34c7",
      "old_mode": 33188,
      "old_path": "src/Transform_inl.h",
      "new_id": "88d6c8728a49af49ae8ed92a91d6e6aebe31d9e5",
      "new_mode": 33188,
      "new_path": "src/Transform_inl.h"
    },
    {
      "type": "modify",
      "old_id": "bb204014de9fa10bd71167652595efc773c740d2",
      "old_mode": 33188,
      "old_path": "tests.c",
      "new_id": "76e5800852787f3f60f4b8dd1248607c08818eee",
      "new_mode": 33188,
      "new_path": "tests.c"
    }
  ]
}