CVE-2018-16435 (Other, published 2018-09-04T00:29Z)
Description: value: Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/mm2/Little-CMS
Files changed:
Projects/VC2017/jpegicc/jpegicc.vcxproj
Projects/VC2017/lcms2_DLL/lcms2_DLL.vcxproj
Projects/VC2017/lcms2_static/lcms2_static.vcxproj
Projects/VC2017/linkicc/linkicc.vcxproj
Projects/VC2017/psicc/psicc.vcxproj
Projects/VC2017/testbed/testbed.vcxproj
Projects/VC2017/tiffdiff/tiffdiff.vcxproj
Projects/VC2017/tifficc/tifficc.vcxproj
Projects/VC2017/transicc/transicc.vcxproj
src/cmscgats.c
Commit message: Upgrade Visual studio 2017 15.8

- Upgrade to 15.8
- Add check on CGATS memory allocation (thanks to Quang Nguyen for
pointing out this)


Vulnerable code:
    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
//  Copyright (c) 1998-2017 Marti Maria Saguer
    t-> Data = (char**)AllocChunk (it8, ((cmsUInt32Number) t->nSamples + 1) * ((cmsUInt32Number) t->nPatches + 1) *sizeof (char*));
    if (t->Data == NULL) {
        SynError(it8, "AllocateDataSet: Unable to allocate data array");

Fixed code:
    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
//  Copyright (c) 1998-2018 Marti Maria Saguer
    if (t -> nSamples < 0 || t->nSamples > 0x7ffe || t->nPatches < 0 || t->nPatches > 0x7ffe)
    {
        SynError(it8, "AllocateDataSet: too much data");
    }
    else {
        t->Data = (char**)AllocChunk(it8, ((cmsUInt32Number)t->nSamples + 1) * ((cmsUInt32Number)t->nPatches + 1) * sizeof(char*));
        if (t->Data == NULL) {
            SynError(it8, "AllocateDataSet: Unable to allocate data array");
        }