File lcms-bnc479606-2.patch of Package lcms
--- lcms-1.17/include/lcms.h
+++ lcms-1.17/include/lcms.h
@@ -1418,7 +1418,10 @@
LCMS_INLINE void* _cmsCalloc(size_t nmemb, size_t size)
{
size_t alloc = nmemb * size;
- if (alloc < nmemb || alloc < size) {
+ if (size == 0) {
+ return _cmsMalloc(0);
+ }
+ if (alloc / size != nmemb) {
return NULL;
}
return _cmsMalloc(alloc);
--- lcms-1.17/src/cmsio0.c
+++ lcms-1.17/src/cmsio0.c
@@ -77,7 +77,11 @@
size_t len = size * count;
size_t extent = ResData -> Pointer + len;
- if (len < size || len < count) {
+ if (len == 0) {
+ return 0;
+ }
+
+ if (len / size != count) {
cmsSignalError(LCMS_ERRC_ABORTED, "Read from memory error. Integer overflow with count / size.");
return 0;
}
--- lcms-1.17/src/cmslut.c
+++ lcms-1.17/src/cmslut.c
@@ -200,14 +200,14 @@
oldCalc = calc;
calc *= NewLUT -> cLutPoints;
- if (calc < oldCalc || calc < NewLUT -> cLutPoints) {
+ if (calc / NewLUT -> cLutPoints != oldCalc) {
return FALSE;
}
}
oldCalc = calc;
calc *= NewLUT -> OutputChan;
- if (calc < oldCalc || calc < NewLUT -> OutputChan) {
+ if (NewLUT -> OutputChan && calc / NewLUT -> OutputChan != oldCalc) {
return FALSE;
}