Fix: CIccXmlArrayType::ParseText() heap-buffer-overflow

[ChrisCoxArt]

Fix issue #178
Also fix some indentation so it matches the usual style, and is easier to read.

[xsscx]

PR229 Repro & Test

          export CXX=clang++
          git clone https://github.com/InternationalColorConsortium/iccDEV.git
          cd iccDEV
          git fetch origin pull/229/head:pr-229
          git checkout pr-229
          cd Build
          cmake -DCMAKE_INSTALL_PREFIX=$HOME/.local -DCMAKE_BUILD_TYPE=Debug -Wno-dev -DCMAKE_CXX_FLAGS="-g -fsanitize=address,undefined -fno-omit-frame-pointer -Wall" -DENABLE_TOOLS=ON -DENABLE_STATIC_LIBS=ON -DENABLE_SHARED_LIBS=ON Cmake/
          make -j$(nproc)
          echo "========= BEGIN INSIDE STUB for PR229 ========="
          cd ../Testing/
          echo "=== Updating PATH ==="
           for d in ../Build/Tools/*; do
            [ -d "$d" ] && export PATH="$(realpath "$d"):$PATH"
           done
          echo "========= BEGIN INSIDE STUB for PR229 ========="
        cd ../Testing/
        echo "=== Updating PATH ==="
         for d in ../Build/Tools/*; do
          [ -d "$d" ] && export PATH="$(realpath "$d"):$PATH"
         done 
echo "========= Create Profiles ========="
          sh CreateAllProfiles.sh
echo "========= Run Tests ========="
          sh RunTests.sh
          cd HDR
          sh mkprofiles.sh
          cd ..
          cd hybrid
          sh BuildAndTest.sh
          cd ..
          cd CalcTest
          sh checkInvalidProfiles.sh
          cd ..
          cd mcs
          sh updateprev.sh
          sh updateprevWithBkgd.sh
          cd ..
echo "========= Regression Tests ========="
          wget https://github.com/xsscx/PatchIccMAX/raw/refs/heads/re231/contrib/UnitTest/cve-2023-46602.icc
          iccDumpProfile cve-2023-46602.icc
          iccRoundTrip cve-2023-46602.icc
          wget https://github.com/xsscx/PatchIccMAX/raw/refs/heads/re231/contrib/UnitTest/icPlatformSignature-ubsan-poc.icc
          iccRoundTrip icPlatformSignature-ubsan-poc.icc
          iccDumpProfile icPlatformSignature-ubsan-poc.icc
          wget https://github.com/xsscx/PatchIccMAX/raw/refs/heads/re231/contrib/UnitTest/icSigMatrixElemType-Read-poc.icc
          iccRoundTrip icSigMatrixElemType-Read-poc.icc
          iccDumpProfile icSigMatrixElemType-Read-poc.icc
          iccToXml icSigMatrixElemType-Read-poc.icc icSigMatrixElemType-Read-poc.xml
          iccToXml icPlatformSignature-ubsan-poc.icc icPlatformSignature-ubsan-poc.xml
          iccToXml cve-2023-46602.icc cve-2023-46602.xml
          iccFromXml icSigMatrixElemType-Read-poc.xml icSigMatrixElemType-Read-rt.icc
          iccFromXml icPlatformSignature-ubsan-poc.xml icPlatformSignature-ubsan-rt.icc
          iccFromXml cve-2023-46602.xml cve-2023-46602-rt.icc
          iccRoundTrip PCC/Lab_float-D50_2deg.icc
          wget https://github.com/xsscx/Commodity-Injection-Signatures/raw/refs/heads/master/graphics/icc/Cat8Lab-D65_2degMeta.icc
          iccRoundTrip Cat8Lab-D65_2degMeta.icc    
          iccRoundTrip sRGB_v4_ICC_preference.icc
echo "========= BEGIN TEST for PR229 heap-buffer-overflow ========="
          cd CMYK-3DLUTs
          iccFromXml CMYK-3DLUTs2.xml CMYK-3DLUTs2.icc
echo "========= Profile Count ========="
          find . -iname "*.icc" | wc -l
echo "========= INSIDE STUB EXIT ========="

Expected Output

========= BEGIN TEST for PR229 =========
Profile parsed.  Profile is invalid, but saved correctly
Warning! - Unknown 'RICC' = 52494343: Unknown platform signature.
Error! - gamutTag: - Incorrect number of input channels.
Error! - gamutTag: - Incorrect number of output channels.

The above Test indicates that PR229 resolves Issue 178 for heap-buffer-overflow and this PR will be Merged.

Thank You @ChrisCoxArt for your time & efforts!
PR229 addressed the heap-buffer-overflow in CIccXmlArrayType::ParseText() reported from Issue 178
Signed-off-by: D Hoyt xss@xss.cx

[xsscx]

Status

Tue Nov 25 10:00:02 AM EST 2025

• Seasoning up to 6 hours to permit additional Comments & Feedback
• This a priority security patch to Merge

[xsscx]

GHSA-jq9m-54gr-c56c