[IT8] Out-of-bound array access on WriteDataFormat about little-cms HOT 3 CLOSED

Thanks for reporting. Should be solved in e85c64e
Please note this affects only to CGATS parser, which is currently only used by command line sample tools.
So, no exploits can be done by that. The ICC parsing and handling does not use this code in any way.

from little-cms.

Here's gdb's output, regarding nSamples and the array index i.

#2  0x0000555555640667 in WriteDataFormat (fp=<optimized out>, it8=0x7ffff7b18010) at cmscgats.c:1855
1855                  WriteStr(fp, t->DataFormat[i]);
(gdb) p i
$1 = 5
(gdb) p *t
$2 = {SheetType = "\"\"\000TS.17", '\000' <repeats 1015 times>, nSamples = 4, nPatches = 0, SampleID = 0, HeaderList = 0x55555f0bfb30, DataFormat = 0x55555f0bfbf8, Data = 0x0}

from little-cms.

Thanks for the patch — I can confirm that this problem has been fixed, thus I'm closing this issue. Thank you for maintaining LCMS — I'm using it on my Linux laptop right now 🤗

from little-cms.