CVE-2013-4160: Other (NVD-CWE-Other)
value: Little CMS (lcms2) before 2.5, as used in OpenJDK 7 and possibly other products, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to (1) cmsStageAllocLabV2ToV4curves, (2) cmsPipelineDup, (3) cmsAllocProfileSequenceDescription, (4) CurvesAlloc, and (5) cmsnamed.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2014-01-21T18:55Z
Repository: https://github.com/mm2/Little-CMS
Language: C
Files changed: ChangeLog, src/cmsnamed.c, src/cmsopt.c
Commit date: 2013-06-25 16:09:16 +0200
Commit message: Non happy-path fixes

Diff: diff --git a/ChangeLog b/ChangeLog
index efdef95..6ef1303 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -118,9 +118,10 @@ Fixed a bug in parametric curves
 Remove spurious tabs added by git merge of pull request
 Added support for VS2012
 Added a simple project for cppcheck
 Rendering intent used when creating the transform is now propagated to profile header in cmsTransform2Devicelink. This is because 7.2.15 in spec 4.3
 Transform2Devicelink now keeps white point when guessing deviceclass is enabled
+Added some checks for non-happy path, mostly failing mallocs
 
 -----------------------
 2.5 Maintenance release
 -----------------------
diff --git a/src/cmsnamed.c b/src/cmsnamed.c
index a916e17..acfd1c8 100644
--- a/src/cmsnamed.c
+++ b/src/cmsnamed.c
@@ -515,12 +515,12 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsAllocNamedColorList(cmsContext ContextID, cmsUIn
     v ->ContextID  = ContextID;
 
     while (v -> Allocated < n)
         GrowNamedColorList(v);
 
-    strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix));
-    strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix));
+    strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix)-1);
+    strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix)-1);
     v->Prefix[32] = v->Suffix[32] = 0;
 
     v -> ColorantCount = ColorantCount;
 
     return v;
@@ -575,13 +575,11 @@ cmsBool  CMSEXPORT cmsAppendNamedColor(cmsNAMEDCOLORLIST* NamedColorList,
     for (i=0; i < 3; i++)
         NamedColorList ->List[NamedColorList ->nColors].PCS[i] = PCS == NULL ? 0 : PCS[i];
 
     if (Name != NULL) {
 
-        strncpy(NamedColorList ->List[NamedColorList ->nColors].Name, Name,
-                    sizeof(NamedColorList ->List[NamedColorList ->nColors].Name));
-
+        strncpy(NamedColorList ->List[NamedColorList ->nColors].Name, Name, cmsMAX_PATH-1);
         NamedColorList ->List[NamedColorList ->nColors].Name[cmsMAX_PATH-1] = 0;
 
     }
     else
         NamedColorList ->List[NamedColorList ->nColors].Name[0] = 0;
@@ -733,10 +731,14 @@ cmsSEQ* CMSEXPORT cmsAllocProfileSequenceDescription(cmsContext ContextID, cmsUI
 
     Seq -> ContextID = ContextID;
     Seq -> seq      = (cmsPSEQDESC*) _cmsCalloc(ContextID, n, sizeof(cmsPSEQDESC));
     Seq -> n        = n;
 
+    if (Seq -> seq == NULL) {
+        _cmsFree(ContextID, Seq);
+        return NULL;
+    }
 
     for (i=0; i < n; i++) {
         Seq -> seq[i].Manufacturer = NULL;
         Seq -> seq[i].Model        = NULL;
         Seq -> seq[i].Description  = NULL;
diff --git a/src/cmsopt.c b/src/cmsopt.c
index 7478e5e..4bdf0a7 100644
--- a/src/cmsopt.c
+++ b/src/cmsopt.c
@@ -1177,10 +1177,20 @@ Curves16Data* CurvesAlloc(cmsContext ContextID, int nCurves, int nElements, cmsT
 
     for (i=0; i < nCurves; i++) {
 
         c16->Curves[i] = _cmsCalloc(ContextID, nElements, sizeof(cmsUInt16Number));
 
+        if (c16->Curves[i] == NULL) {
+
+            for (j=0; j < i; j++) {
+                _cmsFree(ContextID, c16->Curves[j]);
+            }
+            _cmsFree(ContextID, c16->Curves);
+            _cmsFree(ContextID, c16);
+            return NULL;
+        }
+
         if (nElements == 256) {
 
             for (j=0; j < nElements; j++) {
 
                 c16 ->Curves[i][j] = cmsEvalToneCurve16(G[i], FROM_8_TO_16(j));

Vulnerable code:     strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix));
    strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix));
        strncpy(NamedColorList ->List[NamedColorList ->nColors].Name, Name,
                    sizeof(NamedColorList ->List[NamedColorList ->nColors].Name));

Fixed code: Added some checks for non-happy path, mostly failing mallocs
    strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix)-1);
    strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix)-1);
        strncpy(NamedColorList ->List[NamedColorList ->nColors].Name, Name, cmsMAX_PATH-1);
    if (Seq -> seq == NULL) {
        _cmsFree(ContextID, Seq);
        return NULL;
    }
        if (c16->Curves[i] == NULL) {

            for (j=0; j < i; j++) {
                _cmsFree(ContextID, c16->Curves[j]);
            }
            _cmsFree(ContextID, c16->Curves);
            _cmsFree(ContextID, c16);
            return NULL;
        }