Bug 1444734 - Bail out of read_nested_curveType when encountering an invalid source. r=Bas
authorNicolas Silva <nsilva@mozilla.com>
Wed, 20 Jun 2018 10:37:22 +0200
changeset 808744 3dc86f7109f69530d31231ca3f58057cb11521bc
parent 808743 7aaaed1a9ef133175a7f18054302e890e451f9eb
child 808745 49cbcdeaa8bb951088c7e313fcd18fbb4a787cfc
push id113477
push userbmo:cmanchester@mozilla.com
push dateWed, 20 Jun 2018 15:54:34 +0000
reviewersBas
bugs1444734
milestone62.0a1
Bug 1444734 - Bail out of read_nested_curveType when encountering an invalid source. r=Bas
gfx/qcms/iccread.c
--- a/gfx/qcms/iccread.c
+++ b/gfx/qcms/iccread.c
@@ -509,16 +509,17 @@ static void read_nested_curveType(struct
 	uint32_t channel_offset = 0;
 	int i;
 	for (i = 0; i < num_channels; i++) {
 		uint32_t tag_len;
 
 		(*curveArray)[i] = read_curveType(src, curve_offset + channel_offset, &tag_len);
 		if (!(*curveArray)[i]) {
 			invalid_source(src, "invalid nested curveType curve");
+			break;
 		}
 
 		channel_offset += tag_len;
 		// 4 byte aligned
 		if ((tag_len % 4) != 0)
 			channel_offset += 4 - (tag_len % 4);
 	}