infernap12/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2026-02-16 21:35:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

6963489: ZDI-CAN-803: Sun JRE ICC Profile Device Information Tag Remote Code Execution Vulnerability

Browse Source 
Reviewed-by: prr
This commit is contained in:
Andrew Brygin 2010-07-01 12:04:14 +04:00
parent 3eec4fa41e
commit f34c8ae290
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
jdk/src/share/native/sun/java2d/cmm/lcms/LCMS.c
View File

@ -190,12 +190,13 @@ JNIEXPORT jlong JNICALL Java_sun_java2d_cmm_lcms_LCMS_createNativeTransform
"sTrans.xf == NULL");
JNU_ThrowByName(env, "java/awt/color/CMMException",
"Cannot get color transform");
} else {
Disposer_AddRecord(env, disposerRef, LCMS_freeTransform, sTrans.j);
}
if (iccArray != &_iccArray[0]) {
free(iccArray);
}
Disposer_AddRecord(env, disposerRef, LCMS_freeTransform, sTrans.j);
return sTrans.j;
}

6
jdk/src/share/native/sun/java2d/cmm/lcms/cmsxform.c
View File

@ -687,6 +687,9 @@ LPMATSHAPER cmsBuildGrayOutputMatrixShaper(cmsHPROFILE hProfile)
LPGAMMATABLE Shapes1[3];
GrayTRC = cmsReadICCGamma(hProfile, icSigGrayTRCTag);
if (!GrayTRC) {
return NULL;
}
FromLstarToXYZ(GrayTRC, Shapes1);
// Reversing must be done after curve translation
@ -703,6 +706,9 @@ LPMATSHAPER cmsBuildGrayOutputMatrixShaper(cmsHPROFILE hProfile)
// Normal case
GrayTRC = cmsReadICCGammaReversed(hProfile, icSigGrayTRCTag); // Y
if (!GrayTRC) {
return NULL;
}
Shapes[0] = cmsDupGamma(GrayTRC);
Shapes[1] = cmsDupGamma(GrayTRC);