6963489: ZDI-CAN-803: Sun JRE ICC Profile Device Information Tag Remote Code Execution Vulnerability
Reviewed-by: prr
--- a/src/share/native/sun/java2d/cmm/lcms/LCMS.c Wed Jun 30 16:51:19 2010 +0100
+++ b/src/share/native/sun/java2d/cmm/lcms/LCMS.c Thu Jul 01 11:17:31 2010 +0400
@@ -190,12 +190,12 @@ JNIEXPORT jlong JNICALL Java_sun_java2d_
"sTrans.xf == NULL");
JNU_ThrowByName(env, "java/awt/color/CMMException",
"Cannot get color transform");
- }
-
+ } else {
+ Disposer_AddRecord(env, disposerRef, LCMS_freeTransform, sTrans.j);
+ }
if (iccArray != &_iccArray[0]) {
free(iccArray);
}
- Disposer_AddRecord(env, disposerRef, LCMS_freeTransform, sTrans.j);
return sTrans.j;
}
--- a/src/share/native/sun/java2d/cmm/lcms/cmsxform.c Wed Jun 30 16:51:19 2010 +0100
+++ b/src/share/native/sun/java2d/cmm/lcms/cmsxform.c Thu Jul 01 11:17:31 2010 +0400
@@ -687,6 +687,9 @@ LPMATSHAPER cmsBuildGrayOutputMatrixShap
LPGAMMATABLE Shapes1[3];
GrayTRC = cmsReadICCGamma(hProfile, icSigGrayTRCTag);
+ if (!GrayTRC) {
+ return NULL;
+ }
FromLstarToXYZ(GrayTRC, Shapes1);
// Reversing must be done after curve translation
@@ -703,7 +706,9 @@ LPMATSHAPER cmsBuildGrayOutputMatrixShap
// Normal case
GrayTRC = cmsReadICCGammaReversed(hProfile, icSigGrayTRCTag); // Y
-
+ if (!GrayTRC) {
+ return NULL;
+ }
Shapes[0] = cmsDupGamma(GrayTRC);
Shapes[1] = cmsDupGamma(GrayTRC);
Shapes[2] = cmsDupGamma(GrayTRC);