Fix: Type Confusion in icStatusCMM::CIccEvalCompare::EvaluateProfile()

[ChrisCoxArt]

Fix bad pointer cast and leaked memory. Fixes #183

[xsscx]

Bug History

Issue 54 vs Issue 183 heap-buffer-overflow

Issue 54 at Bug 7 addressed a heap-buffer-with PoC: iccFromXML mcs/17ChanWithSpots-MVIS.xml mcs/17ChanWithSpots-MVIS.icc

Contrasted with Issue 183 with PoC: iccFromXml CMYK-3DLUTs2.xml CMYK-3DLUTs2.icc

Knowledgebase

• https://nvd.nist.gov/vuln/detail/CVE-2023-47249
• Bugs from Fuzzing #54

[xsscx]

PR228 Repro

          export CXX=clang++
          git clone https://github.com/InternationalColorConsortium/iccDEV.git
          cd iccDEV
          git fetch origin pull/228/head:pr-228
          git checkout pr-228
          cd Build
          cmake -DCMAKE_INSTALL_PREFIX=$HOME/.local -DCMAKE_BUILD_TYPE=Debug -Wno-dev -DCMAKE_CXX_FLAGS="-g -fsanitize=address,undefined -fno-omit-frame-pointer -Wall" -DENABLE_TOOLS=ON -DENABLE_STATIC_LIBS=ON -DENABLE_SHARED_LIBS=ON Cmake/
          make -j$(nproc)
          cd ../Testing/
          echo "=== Updating PATH ==="
           for d in ../Build/Tools/*; do
            [ -d "$d" ] && export PATH="$(realpath "$d"):$PATH"
           done
          echo "========= BEGIN INSIDE STUB for PR228 ========="
        cd ../Testing/
        echo "=== Updating PATH ==="
         for d in ../Build/Tools/*; do
          [ -d "$d" ] && export PATH="$(realpath "$d"):$PATH"
         done 
echo "========= Create Profiles ========="
          sh CreateAllProfiles.sh
echo "========= Run Tests ========="
          sh RunTests.sh
          cd HDR
          sh mkprofiles.sh
          cd ..
          cd hybrid
          sh BuildAndTest.sh
          cd ..
          cd CalcTest
          sh checkInvalidProfiles.sh
          cd ..
          cd mcs
          sh updateprev.sh
          sh updateprevWithBkgd.sh
          cd ..
echo "========= Regression Tests ========="
          wget https://github.com/xsscx/PatchIccMAX/raw/refs/heads/re231/contrib/UnitTest/cve-2023-46602.icc
          iccDumpProfile cve-2023-46602.icc
          iccRoundTrip cve-2023-46602.icc
          wget https://github.com/xsscx/PatchIccMAX/raw/refs/heads/re231/contrib/UnitTest/icPlatformSignature-ubsan-poc.icc
          iccRoundTrip icPlatformSignature-ubsan-poc.icc
          iccDumpProfile icPlatformSignature-ubsan-poc.icc
          wget https://github.com/xsscx/PatchIccMAX/raw/refs/heads/re231/contrib/UnitTest/icSigMatrixElemType-Read-poc.icc
          iccRoundTrip icSigMatrixElemType-Read-poc.icc
          iccDumpProfile icSigMatrixElemType-Read-poc.icc
          iccToXml icSigMatrixElemType-Read-poc.icc icSigMatrixElemType-Read-poc.xml
          iccToXml icPlatformSignature-ubsan-poc.icc icPlatformSignature-ubsan-poc.xml
          iccToXml cve-2023-46602.icc cve-2023-46602.xml
          iccFromXml icSigMatrixElemType-Read-poc.xml icSigMatrixElemType-Read-rt.icc
          iccFromXml icPlatformSignature-ubsan-poc.xml icPlatformSignature-ubsan-rt.icc
          iccFromXml cve-2023-46602.xml cve-2023-46602-rt.icc
          iccRoundTrip PCC/Lab_float-D50_2deg.icc
          wget https://github.com/xsscx/Commodity-Injection-Signatures/raw/refs/heads/master/graphics/icc/Cat8Lab-D65_2degMeta.icc
          iccRoundTrip Cat8Lab-D65_2degMeta.icc    
          iccRoundTrip sRGB_v4_ICC_preference.icc
echo "========= BEGIN TEST for PR228 Type Confusion ========="
          cd PCC
          iccRoundTrip Lab_float-D50_2deg.icc
echo "========= Profile Count ========="
          find . -iname "*.icc" | wc -l
echo "========= INSIDE STUB EXIT ========="

Expected Output

========= BEGIN TEST for PR228 =========
Profile:          'Lab_float-D50_2deg.icc'
Rendering Intent: Relative Colorimetric
Specified Gamut:  Not Specified

Round Trip 1
------------
Min DeltaE:        0.00
Mean DeltaE:       0.00
Max DeltaE:        0.00

Max L, a, b:   0.000000, 0.000000, 0.000000

Round Trip 2
------------
Min DeltaE:        0.00
Mean DeltaE:       0.00
Max DeltaE:        0.00

Max L, a, b:   0.000000, 0.000000, 0.000000

PRMG Interoperability - Round Trip Results
------------------------------------------------------
DE <= 1.0 (  201613): 100.0%
DE <= 2.0 (  201613): 100.0%
DE <= 3.0 (  201613): 100.0%
DE <= 5.0 (  201613): 100.0%
DE <=10.0 (  201613): 100.0%
Total     (  201613)

The above Test indicates that PR228 resolves Issue 183 for Type Confusion and this PR will be Merged.
Thank You @ChrisCoxArt for your time & efforts!
Signed-off-by: D Hoyt xss@xss.cx

[xsscx]

Status

Tue Nov 25 10:00:02 AM EST 2025

• Seasoning up to 6 hours to permit additional Comments & Feedback
• This a priority security patch to Merge

[xsscx]

GHSA-f2wp-j3fr-938w