Bug 1444734 - Bail out of read_nested_curveType when encountering an invalid source. r=Bas
authorNicolas Silva <nsilva@mozilla.com>
Wed, 20 Jun 2018 10:37:22 +0200
changeset 423136 3dc86f7109f69530d31231ca3f58057cb11521bc
parent 423135 7aaaed1a9ef133175a7f18054302e890e451f9eb
child 423137 49cbcdeaa8bb951088c7e313fcd18fbb4a787cfc
push id34164
push usercsabou@mozilla.com
push dateThu, 21 Jun 2018 01:17:13 +0000
treeherdermozilla-central@d231a3231680 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersBas
bugs1444734
milestone62.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1444734 - Bail out of read_nested_curveType when encountering an invalid source. r=Bas
gfx/qcms/iccread.c
--- a/gfx/qcms/iccread.c
+++ b/gfx/qcms/iccread.c
@@ -509,16 +509,17 @@ static void read_nested_curveType(struct
 	uint32_t channel_offset = 0;
 	int i;
 	for (i = 0; i < num_channels; i++) {
 		uint32_t tag_len;
 
 		(*curveArray)[i] = read_curveType(src, curve_offset + channel_offset, &tag_len);
 		if (!(*curveArray)[i]) {
 			invalid_source(src, "invalid nested curveType curve");
+			break;
 		}
 
 		channel_offset += tag_len;
 		// 4 byte aligned
 		if ((tag_len % 4) != 0)
 			channel_offset += 4 - (tag_len % 4);
 	}