midasmatterhorn 1db56c92d2 cms: bound the ICC curve count before it is multiplied, and read mluc record offsets checked ...

parse_curve computed 12 + n * 2 with n straight from the file and only
checked the 1 << 20 bound afterwards, inside the table arm — on a 32-bit
(wasm32) target, which craft-cms ships branches for, a trC curve count of
0xFFFFFFFF overflows with overflow checks on and panics before the guard
could reject it. The mluc reader computed 16 + k * size unchecked, where
wrapping reads another record's bytes as the language, length and offset
(wrong text, no error) instead of stopping.

Hoist the curve-count guard above the arithmetic and compute the record
offset with checked_mul/checked_add, breaking out when it does not fit.
This ports the app-side fix accepted as PhotoCraft #4976 / PR #5227,
which was never carried into craft-cms. On a 64-bit host both sites are
benign (the arithmetic fits), so the two new tests pass before and after
there; they bite on a 32-bit/overflow-check build, which deserves a
wasm32 CI job — craft-cms has none yet.

2026-10-15 17:58:13 +03:00

..

builtin.rs

craft-cms: separate exact profile-name matches from stand-ins

2026-10-13 03:22:39 +00:00

clut.rs

craft-cms: return errors instead of panicking on caller input

2026-10-13 01:33:07 +00:00

curve.rs

craft-cms: return errors instead of panicking on caller input

2026-10-13 01:33:07 +00:00

gamut.rs

craft-cms: return errors instead of panicking on caller input

2026-10-13 01:33:07 +00:00

lib.rs

craft-cms: return errors instead of panicking on caller input

2026-10-13 01:33:07 +00:00

lut3d.rs

craft-cms: return errors instead of panicking on caller input

2026-10-13 01:33:07 +00:00

lutfile.rs

craft-cms: return errors instead of panicking on caller input

2026-10-13 01:33:07 +00:00

math.rs

craft-cms: built-in Coated FOGRA39 profile fitted to Fogra's data

2026-10-13 01:23:45 +00:00

pipeline.rs

craft-cms: return errors instead of panicking on caller input

2026-10-13 01:33:07 +00:00

profile.rs

cms: bound the ICC curve count before it is multiplied, and read mluc record offsets checked

2026-10-15 17:58:13 +03:00

synth.rs

craft-cms: map device white to device white on every path

2026-10-13 01:50:14 +00:00

transform.rs

craft-cms: map device white to device white on every path

2026-10-13 01:50:14 +00:00

write.rs

Add craft-cms: ICC colour management extracted from PhotoCraft

2026-10-13 01:23:45 +00:00