Is LCMS supposed to be able to recover from all errors if I use
cmsSetErrorHandler and have my handler return 1? It doesn't. It recovers
from most/many.
eg, in cmsBuildOutputMatrixShaper, cmsReadICCGammaReversed does call the
error handler on bad data, but cmsBuildOutputMatrixShaper still calls
cmsAllocMatShaper which dies since InverseShapes[x] is NULL
cmsBuildOutputMatrixShaper(...)
{
...
InverseShapes[0] = cmsReadICCGammaReversed(OutputProfile,
icSigRedTRCTag);
InverseShapes[1] = cmsReadICCGammaReversed(OutputProfile,
icSigGreenTRCTag);
InverseShapes[2] = cmsReadICCGammaReversed(OutputProfile,
icSigBlueTRCTag);
OutMatSh = cmsAllocMatShaper(&DoubleInv, InverseShapes,
MATSHAPER_OUTPUT);
...
}
this is an easy enough problem to produce by taking an existing profile -
throw some random data at it, and load it with cmsOpenProfileFromMem().
repeat this a few times, and you'll get a fatal exception
hence using cmsSetErrorHandler doesn't stop a denial-of-service.
Louis Solomon
www.SteelBytes.com
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Lcms-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/lcms-user
