SBO in CIccTagNum<(icTagTypeSignature)>::GetValues() at IccTagBasic.cpp:6098 #618
Description
Maintainer Repro
2026-02-24 23:16:47 UTC
SCARINESS: 51 (4-byte-write-stack-buffer-overflow)
PoC Replay
Step 2. printf "'RGB '\nicEncodeFloat\n0.5 0.5 0.5\n" | iccApplyNamedCmm /dev/stdin 3 0 sbo-CIccTagStruct-GetElemNumberValue-IccTagComposite_cpp-Line737.icc 0
PoC Expected Output
git show --no-patch --oneline
...
cf28ef4 (HEAD -> master, origin/master, origin/HEAD) Fix: HUAF in CIccCmm::AddXform() (#616)
...
==31660==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7909aee00764 at pc 0x7909b3dc2392 bp 0x7ffc87b835f0 sp 0x7ffc87b835e8
WRITE of size 4 at 0x7909aee00764 thread T0
#0 0x7909b3dc2391 in CIccTagNum<unsigned char, (icTagTypeSignature)1969827896>::GetValues(float*, unsigned int, unsigned int) const IccProfLib/IccTagBasic.cpp:6098:22
#1 0x7909b3df34c5 in CIccTagStruct::GetElemNumberValue(unsigned int, float) IccProfLib/IccTagComposite.cpp:737:14
#2 0x7909b3baa4f8 in CIccDefaultEncProfileConverter::ConvertFromParams(CIccProfile*&, CIccTagStruct*, icHeader*) IccProfLib/IccEncoding.cpp:393:32
#3 0x7909b3bb0925 in icConvertEncodingProfile(CIccProfile*&, CIccProfile*) IccProfLib/IccEncoding.cpp:602:68
#4 0x7909b3abeb80 in CIccXform::Create(CIccProfile*, bool, icRenderingIntent, icXformInterp, IIccProfileConnectionConditions*, icXformLutType, bool, CIccCreateXformHintManager*) IccProfLib/IccCmm.cpp:544:9
#5 0x7909b3b844c9 in CIccNamedColorCmm::AddXform(CIccProfile*, icRenderingIntent, icXformInterp, IIccProfileConnectionConditions*, icXformLutType, bool, CIccCreateXformHintManager*) IccProfLib/IccCmm.cpp:10759:17
#6 0x7909b3b80757 in CIccNamedColorCmm::AddXform(char const*, icRenderingIntent, icXformInterp, IIccProfileConnectionConditions*, icXformLutType, bool, CIccCreateXformHintManager*, bool) IccProfLib/IccCmm.cpp:10509:20
#7 0x5b95ef31d4e9 in main Tools/CmdLine/IccApplyNamedCmm/iccApplyNamedCmm.cpp:381:18
#8 0x7909b2e2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#9 0x7909b2e2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#10 0x5b95ef23f974 in _start (Build/Tools/IccApplyNamedCmm/iccApplyNamedCmm+0x6e974) (BuildId: 5597ccbe10b4bed0d35adcbdf84327e2c16d820e)
Address 0x7909aee00764 is located in stack of thread T0 at offset 36 in frame
#0 0x7909b3df31ff in CIccTagStruct::GetElemNumberValue(unsigned int, float) IccProfLib/IccTagComposite.cpp:728
This frame has 1 object(s):
[32, 36) 'rv' (line 735) <== Memory access at offset 36 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow IccProfLib/IccTagBasic.cpp:6098:22 in CIccTagNum<unsigned char, (icTagTypeSignature)1969827896>::GetValues(float*, unsigned int, unsigned int) const
Shadow bytes around the buggy address:
0x7909aee00480: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x7909aee00500: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x7909aee00580: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x7909aee00600: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x7909aee00680: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
=>0x7909aee00700: f5 f5 f5 f5 f5 f5 f5 f5 f1 f1 f1 f1[04]f3 f3 f3
0x7909aee00780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7909aee00800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7909aee00880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7909aee00900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7909aee00980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==31660==ABORTING
[2026-02-24 23:12:32 UTC] ~/po/research (main)$