Is LCMS supposed to be able to recover from all errors if I
use
cmsSetErrorHandler and have my handler return 1? It
doesn't. It recovers
from most/many.
eg, in cmsBuildOutputMatrixShaper, cmsReadICCGammaReversed
does call the
error handler on bad data, but cmsBuildOutputMatrixShaper
still calls
cmsAllocMatShaper which dies since InverseShapes[x] is NULL
cmsBuildOutputMatrixShaper(...)
{
...
InverseShapes[0] =
cmsReadICCGammaReversed(OutputProfile,
icSigRedTRCTag);
InverseShapes[1] =
cmsReadICCGammaReversed(OutputProfile,
icSigGreenTRCTag);
InverseShapes[2] =
cmsReadICCGammaReversed(OutputProfile,
icSigBlueTRCTag);
OutMatSh = cmsAllocMatShaper(&DoubleInv,
InverseShapes,
MATSHAPER_OUTPUT);
...
}
this is an easy enough problem to produce by taking an
existing profile -
throw some random data at it, and load it with
cmsOpenProfileFromMem().
repeat this a few times, and you'll get a fatal exception
hence using cmsSetErrorHandler doesn't stop a
denial-of-service.
Louis Solomon
www.SteelBytes.com
------------------------------------------------------------
-------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and
take
control of your XML. No limits. Just data. Click to get it
now.
http://sourcefor
ge.net/powerbar/db2/
_______________________________________________
Lcms-user mailing list
Lcms-user lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/lcms-user
|