0012-backport-c0a98d86.patch revision 4d3acf4ec42bf6e838f9060103aff98fbf170794 
1diff --git a/third_party/lcms2-2.6/src/cmsintrp.c b/third_party/lcms2-2.6/src/cmsintrp.c
2index 5d5f35d..14c6856 100644
3--- a/third_party/lcms2-2.6/src/cmsintrp.c
4+++ b/third_party/lcms2-2.6/src/cmsintrp.c
5@@ -215,7 +215,7 @@ void LinLerp1D(register const cmsUInt16Number Value[],
6 // To prevent out of bounds indexing
7 cmsINLINE cmsFloat32Number fclamp(cmsFloat32Number v) 
8 {
9-    return v < 0.0f ? 0.0f : (v > 1.0f ? 1.0f : v);
10+    return ((v < 0.0f) || isnan(v)) ? 0.0f : (v > 1.0f ? 1.0f : v);
11 }
12 
13 // Floating-point version of 1D interpolation
14diff --git a/third_party/lcms2-2.6/src/cmsio0.c b/third_party/lcms2-2.6/src/cmsio0.c
15index 5f9f08a..3ed730a 100644
16--- a/third_party/lcms2-2.6/src/cmsio0.c
17+++ b/third_party/lcms2-2.6/src/cmsio0.c
18@@ -1475,6 +1475,17 @@ void* CMSEXPORT cmsReadTag(cmsHPROFILE hProfile, cmsTagSignature sig)
19     // If the element is already in memory, return the pointer
20     if (Icc -> TagPtrs[n]) {
21 
22+        if (Icc->TagTypeHandlers[n] == NULL) goto Error;
23+
24+        // Sanity check
25+        BaseType = Icc->TagTypeHandlers[n]->Signature;
26+        if (BaseType == 0) goto Error;
27+
28+        TagDescriptor = _cmsGetTagDescriptor(Icc->ContextID, sig);
29+        if (TagDescriptor == NULL) goto Error;
30+
31+        if (!IsTypeSupported(TagDescriptor, BaseType)) goto Error;
32+
33         if (Icc ->TagSaveAsRaw[n]) goto Error;  // We don't support read raw tags as cooked
34 
35         _cmsUnlockMutex(Icc->ContextID, Icc ->UsrMutex);
36diff --git a/third_party/lcms2-2.6/src/cmstypes.c b/third_party/lcms2-2.6/src/cmstypes.c
37index 04dd0c4..386439b 100644
38--- a/third_party/lcms2-2.6/src/cmstypes.c
39+++ b/third_party/lcms2-2.6/src/cmstypes.c
40@@ -4297,8 +4297,12 @@ void *Type_MPEclut_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* io,
41 
42     // Copy MAX_INPUT_DIMENSIONS at most. Expand to cmsUInt32Number
43     nMaxGrids = InputChans > MAX_INPUT_DIMENSIONS ? MAX_INPUT_DIMENSIONS : InputChans;
44-    for (i=0; i < nMaxGrids; i++) GridPoints[i] = (cmsUInt32Number) Dimensions8[i];
45 
46+    for (i = 0; i < nMaxGrids; i++) {
47+        if (Dimensions8[i] == 1) goto Error; // Impossible value, 0 for no CLUT and then 2 at least
48+        GridPoints[i] = (cmsUInt32Number)Dimensions8[i];
49+    }
50+    
51     // Allocate the true CLUT
52     mpe = cmsStageAllocCLutFloatGranular(self ->ContextID, GridPoints, InputChans, OutputChans, NULL);
53     if (mpe == NULL) goto Error;
54