From 80739b842ad0681333d40feda578d04044c8157f Mon Sep 17 00:00:00 2001 From: raftias Date: Thu, 20 Oct 2016 10:38:58 -0700 Subject: [PATCH] Fixed potential read-out-of-bounds issue in ICC profile loading For 8-bit precision color LUT in A2B0 ICC color space profiles it was skipping every 2nd CLUT value and then reading past the end of the CLUT data table. Now it properly increments through 8-bit precision color LUT tables in profiles. BUG=skia: GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2434563007 Review-Url: https://chromiumcodereview.appspot.com/2434563007 --- src/core/SkColorSpace_ICC.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/core/SkColorSpace_ICC.cpp b/src/core/SkColorSpace_ICC.cpp index df665ecd69..6fc3090caf 100644 --- a/src/core/SkColorSpace_ICC.cpp +++ b/src/core/SkColorSpace_ICC.cpp @@ -656,7 +656,7 @@ static bool load_color_lut(sk_sp* colorLUT, uint32_t inputCh const uint8_t* ptr = src + kColorLUTHeaderSize; for (uint32_t i = 0; i < numEntries; i++, ptr += precision) { if (1 == precision) { - table[i] = ((float) ptr[i]) / 255.0f; + table[i] = ((float) *ptr) / 255.0f; } else { table[i] = ((float) read_big_endian_u16(ptr)) / 65535.0f; }