Hello Marti,

 I have a question regarding Type_ColorantTable_Read() routine (cmstypes.c)
 There is a buffer 'Name' of 34 bytes, which is used to read the
colorant name field.
 We read 32 bytes from input and then set 33th byte to zero as a null
terminator.

 The ICC  spec defines the colorant name field as 32-byte field, null
terminated.

 If input data contains null-terminated name, everything is fine.
 However, if it is not null-terminated for some reason (say, corrupted profile),
 then we may get an arbitrary value in 32th byte of the colorant name,
 what probably can cause a problem during future processing.

 My question is: do we really need extra bytes in the 'Name' buffer?

 May I suggest to use 32-byte buffer, and 31th byte as a null-terminator?
 A patch is attached.

Thanks,
Andrew

Attachment: Type_ColorantTable_Read.patch
Description: Binary data

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar
_______________________________________________
Lcms-user mailing list
Lcms-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/lcms-user

Reply via email to