Submitted By: Joe Locash Date: 2026-04-26 Initial Package Version: 2.18 Upstream Status: Applied Origin: Upstream commits da6110b and e0641b1 Description: Fixes CVE-2026-41254 From da6110b1d14abc394633a388209abd5ebedd7ab0 Mon Sep 17 00:00:00 2001 From: Marti Maria Date: Thu, 19 Feb 2026 09:07:20 +0100 Subject: [PATCH] Fix integer overflow in CubeSize() Thanks to @zerojackyi for reporting --- src/cmslut.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/cmslut.c b/src/cmslut.c index 10891486..b2452090 100644 --- a/src/cmslut.c +++ b/src/cmslut.c @@ -460,7 +460,8 @@ void EvaluateCLUTfloatIn16(const cmsFloat32Number In[], cmsFloat32Number Out[], static cmsUInt32Number CubeSize(const cmsUInt32Number Dims[], cmsUInt32Number b) { - cmsUInt32Number rv, dim; + cmsUInt32Number dim; + cmsUInt64Number rv; _cmsAssert(Dims != NULL); From e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc Mon Sep 17 00:00:00 2001 From: Marti Maria Date: Thu, 12 Mar 2026 22:57:35 +0100 Subject: [PATCH] check for overflow Thanks to Guanni Qu for detecting & reporting the issue --- src/cmslut.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/cmslut.c b/src/cmslut.c index a60baf98..65c935fc 100644 --- a/src/cmslut.c +++ b/src/cmslut.c @@ -468,12 +468,12 @@ cmsUInt32Number CubeSize(const cmsUInt32Number Dims[], cmsUInt32Number b) for (rv = 1; b > 0; b--) { dim = Dims[b-1]; - if (dim <= 1) return 0; // Error - - rv *= dim; + if (dim <= 1) return 0; // Check for overflow if (rv > UINT_MAX / dim) return 0; + + rv *= dim; } // Again, prevent overflow