8014098: Better profile validation
authorjchen
Thu, 13 Jun 2013 12:14:37 -0700
changeset 20807 841e21c03f0f
parent 20806 d94588b7854d
child 20808 87159c70b5fd
8014098: Better profile validation Reviewed-by: bae, mschoene, prr
jdk/src/share/native/sun/java2d/cmm/lcms/cmsio0.c
--- a/jdk/src/share/native/sun/java2d/cmm/lcms/cmsio0.c	Thu Jun 13 10:31:21 2013 +0800
+++ b/jdk/src/share/native/sun/java2d/cmm/lcms/cmsio0.c	Thu Jun 13 12:14:37 2013 -0700
@@ -1074,6 +1074,27 @@
 }
 
 
+static
+cmsBool SanityCheck(_cmsICCPROFILE* profile)
+{
+    cmsIOHANDLER* io = profile->IOhandler;
+    if (!io) {
+        return FALSE;
+    }
+
+    if (!io->Seek ||
+        !(io->Seek==NULLSeek || io->Seek==MemorySeek || io->Seek==FileSeek))
+    {
+        return FALSE;
+    }
+    if (!io->Read ||
+        !(io->Read==NULLRead || io->Read==MemoryRead || io->Read==FileRead))
+    {
+        return FALSE;
+    }
+
+    return TRUE;
+}
 
 // Dump tag contents. If the profile is being modified, untouched tags are copied from FileOrig
 static
@@ -1087,6 +1108,7 @@
     cmsTagTypeSignature TypeBase;
     cmsTagTypeHandler* TypeHandler;
 
+    if (!SanityCheck(FileOrig)) return FALSE;
 
     for (i=0; i < Icc -> TagCount; i++) {
 
@@ -1292,8 +1314,8 @@
     // Should we just calculate the needed space?
     if (MemPtr == NULL) {
 
-           *BytesNeeded =  cmsSaveProfileToIOhandler(hProfile, NULL);
-            return TRUE;
+        *BytesNeeded = cmsSaveProfileToIOhandler(hProfile, NULL);
+        return (*BytesNeeded == 0 ? FALSE : TRUE);
     }
 
     // That is a real write operation