changeset 435:1f9e4b58a1f9

6963489: ZDI-CAN-803: Sun JRE ICC Profile Device Information Tag Remote Code Execution Vulnerability Reviewed-by: prr
author bae
date Thu, 01 Jul 2010 11:17:31 +0400
parents 34dd517c7183
children 7fe7aa39b5dc
files src/share/native/sun/java2d/cmm/lcms/LCMS.c src/share/native/sun/java2d/cmm/lcms/cmsxform.c
diffstat 2 files changed, 8 insertions(+), 3 deletions(-) [+]
line wrap: on
line diff
--- a/src/share/native/sun/java2d/cmm/lcms/LCMS.c	Wed Jun 30 16:51:19 2010 +0100
+++ b/src/share/native/sun/java2d/cmm/lcms/LCMS.c	Thu Jul 01 11:17:31 2010 +0400
@@ -190,12 +190,12 @@
                                        "sTrans.xf == NULL");
         JNU_ThrowByName(env, "java/awt/color/CMMException",
                         "Cannot get color transform");
+    } else {
+        Disposer_AddRecord(env, disposerRef, LCMS_freeTransform, sTrans.j);
     }
-
     if (iccArray != &_iccArray[0]) {
         free(iccArray);
     }
-    Disposer_AddRecord(env, disposerRef, LCMS_freeTransform, sTrans.j);
     return sTrans.j;
 }
 
--- a/src/share/native/sun/java2d/cmm/lcms/cmsxform.c	Wed Jun 30 16:51:19 2010 +0100
+++ b/src/share/native/sun/java2d/cmm/lcms/cmsxform.c	Thu Jul 01 11:17:31 2010 +0400
@@ -687,6 +687,9 @@
                 LPGAMMATABLE Shapes1[3];
 
                 GrayTRC = cmsReadICCGamma(hProfile, icSigGrayTRCTag);
+                if (!GrayTRC) {
+                    return NULL;
+                }
                 FromLstarToXYZ(GrayTRC, Shapes1);
 
                 // Reversing must be done after curve translation
@@ -703,7 +706,9 @@
                 // Normal case
 
                 GrayTRC = cmsReadICCGammaReversed(hProfile, icSigGrayTRCTag);   // Y
-
+                if (!GrayTRC) {
+                    return NULL;
+                }
                 Shapes[0] = cmsDupGamma(GrayTRC);
                 Shapes[1] = cmsDupGamma(GrayTRC);
                 Shapes[2] = cmsDupGamma(GrayTRC);