A possible overflow in cmsIsCLUT

[hopper-vul]

Hi,
when fuzzing the lcms, we found a crash happend in cmsIsCLUT.

In cmsIsCLUT, if the provided UsedDirection is LCMS_USED_AS_INPUT or LCMS_USED_AS_OUTPUT, the TagTable will be assigned with a four-elements array. Whereas when the provided Intent argument greater than four, a overflow as to TabTable will happen, as the following codes show:

 switch (UsedDirection) {
       case LCMS_USED_AS_INPUT: TagTable = Device2PCS16; break;
       case LCMS_USED_AS_OUTPUT:TagTable = PCS2Device16; break;
     ...
    }

return cmsIsTag(hProfile, TagTable[Intent]);  // overflow

Maybe there needs some checks of Intent in cmsIsCLUT? or some constraint description about Intent in doc?