sanitize floating point read

Added a check for floating point validation

2 files changed, 75 insertions, 1 deletions

diff --git a/testbed/bad_mpe.icc b/testbed/bad_mpe.icc
new file mode 100644
index 0000000..5a86c6c
--- /dev/null
+++ b/testbed/bad_mpe.icc
diff --git a/testbed/testcms2.c b/testbed/testcms2.c
index f4e6bf1..166b528 100644
--- a/testbed/testcms2.c
+++ b/testbed/testcms2.c
@@ -7995,9 +7995,81 @@ int CheckSE(void)
         return 0;
 
     return 1;
-
 }
 
+/**
+* Bug reported.
+*/
+static
+int CheckForgedMPE(void) 
+{
+    cmsUInt32Number i;
+    cmsHPROFILE srcProfile;
+    cmsHPROFILE dstProfile;
+    cmsColorSpaceSignature srcCS;
+    cmsUInt32Number nSrcComponents;
+    cmsUInt32Number srcFormat;
+    cmsUInt32Number intent = 0;
+    cmsUInt32Number flags = 0;
+    cmsHTRANSFORM hTransform;
+    cmsUInt8Number output[4];
+
+    srcProfile = cmsOpenProfileFromFile("bad_mpe.icc", "r");
+    if (!srcProfile)
+        return 0;
+
+    dstProfile = cmsCreate_sRGBProfile();
+    if (!dstProfile) {
+        cmsCloseProfile(srcProfile);
+        return 0;
+    }
+
+    srcCS = cmsGetColorSpace(srcProfile);
+    nSrcComponents = cmsChannelsOf(srcCS);
+    
+    if (srcCS == cmsSigLabData) {
+        srcFormat =
+            COLORSPACE_SH(PT_Lab) | CHANNELS_SH(nSrcComponents) | BYTES_SH(0);
+    }
+    else {
+        srcFormat =
+            COLORSPACE_SH(PT_ANY) | CHANNELS_SH(nSrcComponents) | BYTES_SH(1);
+    }
+
+    cmsSetLogErrorHandler(ErrorReportingFunction);
+
+    hTransform = cmsCreateTransform(srcProfile, srcFormat, dstProfile,
+        TYPE_BGR_8, intent, flags);
+    cmsCloseProfile(srcProfile);
+    cmsCloseProfile(dstProfile);
+
+    cmsSetLogErrorHandler(FatalErrorQuit);    
+
+    // Should report error
+    if (!TrappedError) return 0;
+
+    TrappedError = FALSE;
+
+    // Transform should NOT be created
+    if (!hTransform) return 1;
+    
+    // Never should reach here
+    if (T_BYTES(srcFormat) == 0) {  // 0 means double
+        double input[128];
+        for (i = 0; i < nSrcComponents; i++)
+            input[i] = 0.5f;
+        cmsDoTransform(hTransform, input, output, 1);
+    }
+    else {
+        cmsUInt8Number input[128];
+        for (i = 0; i < nSrcComponents; i++)
+            input[i] = 128;
+        cmsDoTransform(hTransform, input, output, 1);
+    }
+    cmsDeleteTransform(hTransform);
+
+    return 0;
+}
 
 
 // --------------------------------------------------------------------------------------------------
@@ -8645,6 +8717,8 @@ int main(int argc, char* argv[])
 
     Check("Transform line stride RGB", CheckTransformLineStride);
 
+    Check("Forged MPE profile", CheckForgedMPE);
+
     }
 
     if (DoPluginTests)