Øyvind Kolås · Øyvind Kolås · Øyvind Kolås · Øyvind Kolås · Øyvind Kolås · Jeremy Bicha
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,10 @@ The NEWS file in the babl source tree is the source location for
 the news section both in the README and the webpage.
                                                                          -->

+2022-11-13 babl-0.1.98                                              </dt><dd>
+More robust bounds protection in ICC handling, avoid garbage collecting lookup
+tables in-line with processing.
+                                                                    </dd><dt>
 2022-08-23 babl-0.1.96                                              </dt><dd>
 Minor changes from 0.1.94, fixing build.
                                                                    </dd><dt>

--- a/babl/babl-fish-path.c
+++ b/babl/babl-fish-path.c
@@ -106,8 +106,20 @@ babl_gc_fishes (void)
     fprintf (stdout, "\e[H\e[2J");
  }
  babl_fish_class_for_each (gc_fishes, &context);
-  //malloc_trim (0); 
-  //  is responsibility of higher layers
+}
+
+static long babl_conv_counter = 0;
+
+void
+babl_gc (void)
+{
+  if (babl_conv_counter > 1000 * 1000 * 10) // run gc every 10 megapixels
+  {
+    babl_conv_counter = 0;
+    babl_gc_fishes ();
+    //malloc_trim (0); 
+    //  is responsibility of higher layers
+  }
 }

 #define BABL_LIKELY(x)      __builtin_expect(!!(x), 1)
@@ -1227,13 +1239,7 @@ babl_fish_path_process (const Babl *babl,
  }
  else
  {
-    static long conv_counter = 0;
-    conv_counter+=n;
-    if (conv_counter > 1000 * 1000 * 10) // run gc every 10 megapixels
-    {
-      conv_counter = 0;
-      babl_gc_fishes ();
-    }
+    babl_conv_counter+=n;
  }
  process_conversion_path (babl->fish_path.conversion_list,
                           source,

--- a/babl/babl-icc.c
+++ b/babl/babl-icc.c
@@ -361,10 +361,23 @@ icc_tag (ICC        *state,
     sign_t sign = icc_read (sign, TAG_COUNT_OFF + 4 + 12 * t);
     if (!strcmp (sign.str, tag))
     {
+        int off = icc_read (u32, TAG_COUNT_OFF + 4 + 12* t + 4);
+        int len = icc_read (u32, TAG_COUNT_OFF + 4 + 12* t + 4*2);
+
+        if (off + len > state->length || off < 0)
+        {
+          if (offset)
+            *offset = 0;
+          if (el_length)
+            *el_length = 0;
+           return 0; // broken input
+        }
+
        if (offset)
-          *offset = icc_read (u32, TAG_COUNT_OFF + 4 + 12* t + 4);
+          *offset = off;
        if (el_length)
-          *el_length = icc_read (u32, TAG_COUNT_OFF + 4 + 12* t + 4*2);
+          *el_length = len;
+
        return 1;
     }
  }

--- a/babl/babl.h
+++ b/babl/babl.h
@@ -724,6 +724,18 @@ typedef void (*BablFishProcess) (const Babl *babl, const char *src, char *dst, l
 BablFishProcess babl_fish_get_process (const Babl *babl);


+/**
+ * babl_gc: (skip)
+ *
+ * Do a babl fish garbage collection cycle, should only be called
+ * from the main thread with no concurrent babl processing in other
+ * threads in paralell.
+ *
+ * Since: babl-0.1.98
+ */
+void babl_gc (void);
+
+
 /* values below this are stored associated with this value, it should also be
 * used as a generic alpha zero epsilon in GEGL to keep the threshold effects
 * on one known value.

--- a/export-symbols
+++ b/export-symbols
@@ -72,6 +72,7 @@ babl_db_exist_by_id
 babl_db_each
 babl_formats_count
 babl_format_class_for_each
+babl_gc
 babl_model_class_for_each
 babl_type_class_for_each
 babl_conversion_class_for_each

--- a/git-version.h
+++ b/git-version.h
 #ifndef __BABL_GIT_VERSION_H__
 #define __BABL_GIT_VERSION_H__

-#define BABL_GIT_VERSION "BABL_0_1_96"
+#define BABL_GIT_VERSION "BABL_0_1_98"

 #endif /* __BABL_GIT_VERSION_H__ */
--- a/meson.build
+++ b/meson.build
 project('babl', 'c',
  license: 'LGPL3+',
-  version: '0.1.96',
+  version: '0.1.98',
  meson_version: '>=0.54.0',
  default_options: [
    'buildtype=debugoptimized'