--- a/jdk/src/java.desktop/share/native/liblcms/cmsio0.c	Tue Jul 12 16:46:45 2016 +0100
+++ b/jdk/src/java.desktop/share/native/liblcms/cmsio0.c	Thu Jul 14 11:55:09 2016 -0700
@@ -1543,6 +1543,13 @@
     // If the element is already in memory, return the pointer
     if (Icc -> TagPtrs[n]) {
 
+        if (Icc -> TagTypeHandlers[n] == NULL) goto Error;
+        BaseType = Icc -> TagTypeHandlers[n]->Signature;
+        if (BaseType == 0) goto Error;
+        TagDescriptor = _cmsGetTagDescriptor(Icc-> ContextID, sig);
+        if (TagDescriptor == NULL) goto Error;
+        if (!IsTypeSupported(TagDescriptor, BaseType)) goto Error;
+
         if (Icc ->TagSaveAsRaw[n]) goto Error;  // We don't support read raw tags as cooked
 
         _cmsUnlockMutex(Icc->ContextID, Icc ->UsrMutex);