Submitted By: Joe Locash <jlocash at gmail dot com>
Date: 2026-04-26
Initial Package Version: 2.18
Upstream Status: Applied
Origin: Upstream commits da6110b and e0641b1
Description: Fixes CVE-2026-41254
From da6110b1d14abc394633a388209abd5ebedd7ab0 Mon Sep 17 00:00:00 2001
From: Marti Maria <marti.maria@littlecms.com>
Date: Thu, 19 Feb 2026 09:07:20 +0100
Subject: [PATCH] Fix integer overflow in CubeSize()
Thanks to @zerojackyi for reporting
---
src/cmslut.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/cmslut.c b/src/cmslut.c
index 10891486..b2452090 100644
|
a
|
b
|
void EvaluateCLUTfloatIn16(const cmsFloat32Number In[], cmsFloat32Number Out[],
|
| 460 | 460 | static |
| 461 | 461 | cmsUInt32Number CubeSize(const cmsUInt32Number Dims[], cmsUInt32Number b) |
| 462 | 462 | { |
| 463 | | cmsUInt32Number rv, dim; |
| | 463 | cmsUInt32Number dim; |
| | 464 | cmsUInt64Number rv; |
| 464 | 465 | |
| 465 | 466 | _cmsAssert(Dims != NULL); |
| 466 | 467 | |
From e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc Mon Sep 17 00:00:00 2001
From: Marti Maria <marti.maria@littlecms.com>
Date: Thu, 12 Mar 2026 22:57:35 +0100
Subject: [PATCH] check for overflow
Thanks to Guanni Qu for detecting & reporting the issue
---
src/cmslut.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/src/cmslut.c b/src/cmslut.c
index a60baf98..65c935fc 100644
|
a
|
b
|
cmsUInt32Number CubeSize(const cmsUInt32Number Dims[], cmsUInt32Number b)
|
| 468 | 468 | for (rv = 1; b > 0; b--) { |
| 469 | 469 | |
| 470 | 470 | dim = Dims[b-1]; |
| 471 | | if (dim <= 1) return 0; // Error |
| 472 | | |
| 473 | | rv *= dim; |
| | 471 | if (dim <= 1) return 0; |
| 474 | 472 | |
| 475 | 473 | // Check for overflow |
| 476 | 474 | if (rv > UINT_MAX / dim) return 0; |
| | 475 | |
| | 476 | rv *= dim; |
| 477 | 477 | } |
| 478 | 478 | |
| 479 | 479 | // Again, prevent overflow |
