CVE-2018-16435: Integer Overflow or Wraparound (CWE-190)
value: Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 5.5
Published: 2018-09-04T00:29Z
Repository: https://github.com/mm2/Little-CMS
Language: Other
Files changed: Projects/VC2017/jpegicc/jpegicc.vcxproj, Projects/VC2017/lcms2_DLL/lcms2_DLL.vcxproj, Projects/VC2017/lcms2_static/lcms2_static.vcxproj, Projects/VC2017/linkicc/linkicc.vcxproj, Projects/VC2017/psicc/psicc.vcxproj, Projects/VC2017/testbed/testbed.vcxproj, Projects/VC2017/tiffdiff/tiffdiff.vcxproj, Projects/VC2017/tifficc/tifficc.vcxproj, Projects/VC2017/transicc/transicc.vcxproj, src/cmscgats.c
Commit date: 2018-08-15 20:07:56 +0200
Commit message: Upgrade Visual studio 2017 15.8

- Upgrade to 15.8
- Add check on CGATS memory allocation (thanks to Quang Nguyen for
pointing out this)

Diff: diff --git a/Projects/VC2017/jpegicc/jpegicc.vcxproj b/Projects/VC2017/jpegicc/jpegicc.vcxproj
index ab26a53..39cfd00 100644
--- a/Projects/VC2017/jpegicc/jpegicc.vcxproj
+++ b/Projects/VC2017/jpegicc/jpegicc.vcxproj
@@ -20,10 +20,11 @@
   </ItemGroup>
   <PropertyGroup Label="Globals">
     <ProjectGuid>{62812507-F926-4968-96A9-17678460AD90}</ProjectGuid>
     <RootNamespace>jpegicc</RootNamespace>
     <Keyword>Win32Proj</Keyword>
+    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <CharacterSet>Unicode</CharacterSet>
diff --git a/Projects/VC2017/lcms2_DLL/lcms2_DLL.vcxproj b/Projects/VC2017/lcms2_DLL/lcms2_DLL.vcxproj
index 4c8aa3f..d1bf3eb 100644
--- a/Projects/VC2017/lcms2_DLL/lcms2_DLL.vcxproj
+++ b/Projects/VC2017/lcms2_DLL/lcms2_DLL.vcxproj
@@ -20,11 +20,11 @@
   </ItemGroup>
   <PropertyGroup Label="Globals">
     <ProjectGuid>{8C51BE48-ADB8-4089-A9EC-F6BF993A0548}</ProjectGuid>
     <RootNamespace>lcms2_DLL</RootNamespace>
     <Keyword>Win32Proj</Keyword>
-    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
+    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>DynamicLibrary</ConfigurationType>
     <CharacterSet>Unicode</CharacterSet>
diff --git a/Projects/VC2017/lcms2_static/lcms2_static.vcxproj b/Projects/VC2017/lcms2_static/lcms2_static.vcxproj
index 2a9988a..9fc05ce 100644
--- a/Projects/VC2017/lcms2_static/lcms2_static.vcxproj
+++ b/Projects/VC2017/lcms2_static/lcms2_static.vcxproj
@@ -20,11 +20,11 @@
   </ItemGroup>
   <PropertyGroup Label="Globals">
     <ProjectGuid>{71DEDE59-3F1E-486B-A899-4283000F76B5}</ProjectGuid>
     <RootNamespace>lcms2_static</RootNamespace>
     <Keyword>Win32Proj</Keyword>
-    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
+    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>StaticLibrary</ConfigurationType>
     <CharacterSet>Unicode</CharacterSet>
diff --git a/Projects/VC2017/linkicc/linkicc.vcxproj b/Projects/VC2017/linkicc/linkicc.vcxproj
index 30c2b4e..51586dd 100644
--- a/Projects/VC2017/linkicc/linkicc.vcxproj
+++ b/Projects/VC2017/linkicc/linkicc.vcxproj
@@ -20,11 +20,11 @@
   </ItemGroup>
   <PropertyGroup Label="Globals">
     <ProjectGuid>{FBFBE1DC-DB84-4BA1-9552-B4780F457849}</ProjectGuid>
     <RootNamespace>linkicc</RootNamespace>
     <Keyword>Win32Proj</Keyword>
-    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
+    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <CharacterSet>Unicode</CharacterSet>
diff --git a/Projects/VC2017/psicc/psicc.vcxproj b/Projects/VC2017/psicc/psicc.vcxproj
index 9dcf89a..8f26e12 100644
--- a/Projects/VC2017/psicc/psicc.vcxproj
+++ b/Projects/VC2017/psicc/psicc.vcxproj
@@ -20,11 +20,11 @@
   </ItemGroup>
   <PropertyGroup Label="Globals">
     <ProjectGuid>{EF6A8851-65FE-46F5-B9EF-14F0B671F693}</ProjectGuid>
     <RootNamespace>psicc</RootNamespace>
     <Keyword>Win32Proj</Keyword>
-    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
+    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <CharacterSet>Unicode</CharacterSet>
diff --git a/Projects/VC2017/testbed/testbed.vcxproj b/Projects/VC2017/testbed/testbed.vcxproj
index 0af3762..3f6aea3 100644
--- a/Projects/VC2017/testbed/testbed.vcxproj
+++ b/Projects/VC2017/testbed/testbed.vcxproj
@@ -20,11 +20,11 @@
   </ItemGroup>
   <PropertyGroup Label="Globals">
     <ProjectGuid>{928A3A2B-46EF-4279-959C-513B3652FF0E}</ProjectGuid>
     <RootNamespace>testbed</RootNamespace>
     <Keyword>Win32Proj</Keyword>
-    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
+    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <CharacterSet>Unicode</CharacterSet>
diff --git a/Projects/VC2017/tiffdiff/tiffdiff.vcxproj b/Projects/VC2017/tiffdiff/tiffdiff.vcxproj
index 7edfe28..3a6d837 100644
--- a/Projects/VC2017/tiffdiff/tiffdiff.vcxproj
+++ b/Projects/VC2017/tiffdiff/tiffdiff.vcxproj
@@ -20,11 +20,11 @@
   </ItemGroup>
   <PropertyGroup Label="Globals">
     <ProjectGuid>{75B91835-CCD7-48BE-A606-A9C997D5DBEE}</ProjectGuid>
     <RootNamespace>tiffdiff</RootNamespace>
     <Keyword>Win32Proj</Keyword>
-    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
+    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <CharacterSet>Unicode</CharacterSet>
diff --git a/Projects/VC2017/tifficc/tifficc.vcxproj b/Projects/VC2017/tifficc/tifficc.vcxproj
index cd9f04c..5ef954f 100644
--- a/Projects/VC2017/tifficc/tifficc.vcxproj
+++ b/Projects/VC2017/tifficc/tifficc.vcxproj
@@ -20,11 +20,11 @@
   </ItemGroup>
   <PropertyGroup Label="Globals">
     <ProjectGuid>{2256DE16-ED92-4A6F-9C54-F65BB61E64A2}</ProjectGuid>
     <RootNamespace>tifficc</RootNamespace>
     <Keyword>Win32Proj</Keyword>
-    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
+    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <CharacterSet>Unicode</CharacterSet>
diff --git a/Projects/VC2017/transicc/transicc.vcxproj b/Projects/VC2017/transicc/transicc.vcxproj
index d9b77c6..b3173d8 100644
--- a/Projects/VC2017/transicc/transicc.vcxproj
+++ b/Projects/VC2017/transicc/transicc.vcxproj
@@ -20,10 +20,11 @@
   </ItemGroup>
   <PropertyGroup Label="Globals">
     <ProjectGuid>{9EE22D66-C849-474C-9ED5-C3E141DAB160}</ProjectGuid>
     <RootNamespace>transicc</RootNamespace>
     <Keyword>Win32Proj</Keyword>
+    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <CharacterSet>Unicode</CharacterSet>
diff --git a/src/cmscgats.c b/src/cmscgats.c
index 1a87613..8c3e96d 100644
--- a/src/cmscgats.c
+++ b/src/cmscgats.c
@@ -1,9 +1,9 @@
 //---------------------------------------------------------------------------------
 //
 //  Little Color Management System
-//  Copyright (c) 1998-2017 Marti Maria Saguer
+//  Copyright (c) 1998-2018 Marti Maria Saguer
 //
 // Permission is hereby granted, free of charge, to any person obtaining
 // a copy of this software and associated documentation files (the "Software"),
 // to deal in the Software without restriction, including without limitation
 // the rights to use, copy, modify, merge, publish, distribute, sublicense,
@@ -1504,14 +1504,20 @@ void AllocateDataSet(cmsIT8* it8)
     if (t -> Data) return;    // Already allocated
 
     t-> nSamples   = atoi(cmsIT8GetProperty(it8, "NUMBER_OF_FIELDS"));
     t-> nPatches   = atoi(cmsIT8GetProperty(it8, "NUMBER_OF_SETS"));
 
-    t-> Data = (char**)AllocChunk (it8, ((cmsUInt32Number) t->nSamples + 1) * ((cmsUInt32Number) t->nPatches + 1) *sizeof (char*));
-    if (t->Data == NULL) {
+    if (t -> nSamples < 0 || t->nSamples > 0x7ffe || t->nPatches < 0 || t->nPatches > 0x7ffe)
+    {
+        SynError(it8, "AllocateDataSet: too much data");
+    }
+    else {
+        t->Data = (char**)AllocChunk(it8, ((cmsUInt32Number)t->nSamples + 1) * ((cmsUInt32Number)t->nPatches + 1) * sizeof(char*));
+        if (t->Data == NULL) {
 
-        SynError(it8, "AllocateDataSet: Unable to allocate data array");
+            SynError(it8, "AllocateDataSet: Unable to allocate data array");
+        }
     }
 
 }
 
 static

Vulnerable code:     <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
//  Copyright (c) 1998-2017 Marti Maria Saguer
    t-> Data = (char**)AllocChunk (it8, ((cmsUInt32Number) t->nSamples + 1) * ((cmsUInt32Number) t->nPatches + 1) *sizeof (char*));
    if (t->Data == NULL) {
        SynError(it8, "AllocateDataSet: Unable to allocate data array");
Fixed code:     <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
//  Copyright (c) 1998-2018 Marti Maria Saguer
    if (t -> nSamples < 0 || t->nSamples > 0x7ffe || t->nPatches < 0 || t->nPatches > 0x7ffe)
    {
        SynError(it8, "AllocateDataSet: too much data");
    }
    else {
        t->Data = (char**)AllocChunk(it8, ((cmsUInt32Number)t->nSamples + 1) * ((cmsUInt32Number)t->nPatches + 1) * sizeof(char*));
        if (t->Data == NULL) {
            SynError(it8, "AllocateDataSet: Unable to allocate data array");
        }