8347377: Add validation checks for ICC_Profile header fields

src/java.desktop/share/classes/java/awt/color/ICC_ColorSpace.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2014, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2025, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -114,13 +114,14 @@ public ICC_ColorSpace (ICC_Profile profile) {
         int profileClass = profile.getProfileClass();
 
         /* REMIND - is NAMEDCOLOR OK? */
-        if ((profileClass != ICC_Profile.CLASS_INPUT) &&
-            (profileClass != ICC_Profile.CLASS_DISPLAY) &&
-            (profileClass != ICC_Profile.CLASS_OUTPUT) &&
-            (profileClass != ICC_Profile.CLASS_COLORSPACECONVERSION) &&
-            (profileClass != ICC_Profile.CLASS_NAMEDCOLOR) &&
-            (profileClass != ICC_Profile.CLASS_ABSTRACT)) {
-            throw new IllegalArgumentException("Invalid profile type");
+        if (profileClass != ICC_Profile.CLASS_INPUT
+                && profileClass != ICC_Profile.CLASS_DISPLAY
+                && profileClass != ICC_Profile.CLASS_OUTPUT
+                && profileClass != ICC_Profile.CLASS_DEVICELINK
+                && profileClass != ICC_Profile.CLASS_COLORSPACECONVERSION
+                && profileClass != ICC_Profile.CLASS_NAMEDCOLOR
+                && profileClass != ICC_Profile.CLASS_ABSTRACT) {
+            throw new IllegalArgumentException("Invalid profile class");
         }
 
         thisProfile = profile;

src/java.desktop/share/classes/java/awt/color/ICC_Profile.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2017, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2025, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -722,6 +722,7 @@ public class ICC_Profile implements Serializable {
      */
     public static final int icXYZNumberX       = 8;    /* XYZNumber X */
 
+    private static final int HEADER_SIZE = 128;
 
     /**
      * Constructs an ICC_Profile object with a given ID.
@@ -773,6 +774,10 @@ public static ICC_Profile getInstance(byte[] data) {
         ProfileDataVerifier.verify(data);
 
         try {
+            byte[] theHeader = new byte[HEADER_SIZE];
+            System.arraycopy(data, 0, theHeader, 0, HEADER_SIZE);
+            verifyHeader(theHeader);
+
             p = CMSManager.getModule().loadProfile(data);
         } catch (CMMException c) {
             throw new IllegalArgumentException("Invalid ICC Profile Data");
@@ -1092,16 +1097,18 @@ public int getMinorVersion() {
      * @return One of the predefined profile class constants.
      */
     public int getProfileClass() {
-    byte[] theHeader;
-    int theClassSig, theClass;
 
         ProfileDeferralInfo info = deferralInfo;
         if (info != null) {
             return info.profileClass;
         }
 
-        theHeader = getData(icSigHead);
+        byte[] theHeader = getData(icSigHead);
+        return getProfileClass(theHeader);
+    }
 
+    private static int getProfileClass(byte[] theHeader) {
+        int theClassSig, theClass;
         theClassSig = intFromBigEndian (theHeader, icHdrDeviceClass);
 
         switch (theClassSig) {
@@ -1171,6 +1178,11 @@ static int getColorSpaceType(Profile p) {
         return theColorSpace;
     }
 
+    private static int getColorSpaceType(byte[] theHeader) {
+        int theColorSpaceSig = intFromBigEndian(theHeader, icHdrColorSpace);
+        return iccCStoJCS(theColorSpaceSig);
+    }
+
     /**
      * Returns the color space type of the Profile Connection Space (PCS).
      * Returns one of the color space type constants defined by the
@@ -1200,6 +1212,29 @@ static int getPCSType(Profile p) {
     }
 
 
+    private static int getPCSType(byte[] theHeader) {
+        int thePCSSig = intFromBigEndian(theHeader, icHdrPcs);
+        int theDeviceClass = intFromBigEndian(theHeader, icHdrDeviceClass);
+        int thePCSType;
+
+        if (theDeviceClass == icSigLinkClass) {
+            return iccCStoJCS(thePCSSig);
+        } else {
+            switch (thePCSSig) {
+                case icSigXYZData:
+                    thePCSType = ColorSpace.TYPE_XYZ;
+                    break;
+                case icSigLabData:
+                    thePCSType = ColorSpace.TYPE_Lab;
+                    break;
+                default:
+                    throw new IllegalArgumentException("Unexpected PCS type");
+            };
+        }
+
+        return thePCSType;
+    }
+
     /**
      * Write this ICC_Profile to a file.
      *
@@ -1324,12 +1359,49 @@ static byte[] getData(Profile p, int tagSignature) {
      * @see #getData
      */
     public void setData(int tagSignature, byte[] tagData) {
+        if (tagSignature == ICC_Profile.icSigHead) {
+            verifyHeader(tagData);
+        }
 
         activate();
 
         CMSManager.getModule().setTagData(cmmProfile, tagSignature, tagData);
     }
 
+    private static void verifyHeader(byte[] data) {
+        if (data == null || data.length < HEADER_SIZE) {
+            throw new IllegalArgumentException("Invalid header data");
+        }
+        getProfileClass(data);
+        getColorSpaceType(data);
+        getPCSType(data);
+        checkRenderingIntent(data);
+    }
+
+    private static boolean checkRenderingIntent(byte[] header) {
+        int index = ICC_Profile.icHdrRenderingIntent;
+
+        /* According to ICC spec, only the least-significant 16 bits shall be
+         * used to encode the rendering intent. The most significant 16 bits
+         * shall be set to zero. Thus, we are ignoring two most significant
+         * bytes here. Please refer ICC Spec Document for more details.
+         */
+        int renderingIntent = ((header[index+2] & 0xff) <<  8) |
+                              (header[index+3] & 0xff);
+
+        switch (renderingIntent) {
+            case icPerceptual:
+            case icMediaRelativeColorimetric:
+            case icSaturation:
+            case icAbsoluteColorimetric:
+                break;
+            default:
+                throw new IllegalArgumentException("Unknown Rendering Intent");
+        }
+
+        return true;
+    }
+
     /**
      * Sets the rendering intent of the profile.
      * This is used to select the proper transform from a profile that

src/java.desktop/share/native/liblcms/LCMS.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2007, 2025, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -31,43 +31,9 @@
 #include "Trace.h"
 #include "Disposer.h"
 #include <lcms2.h>
+#include <lcms2_plugin.h>
 #include "jlong.h"
 
-
-#define ALIGNLONG(x) (((x)+3) & ~(3))         // Aligns to DWORD boundary
-
-#ifdef USE_BIG_ENDIAN
-#define AdjustEndianess32(a)
-#else
-
-static
-void AdjustEndianess32(cmsUInt8Number *pByte)
-{
-    cmsUInt8Number temp1;
-    cmsUInt8Number temp2;
-
-    temp1 = *pByte++;
-    temp2 = *pByte++;
-    *(pByte-1) = *pByte;
-    *pByte++ = temp2;
-    *(pByte-3) = *pByte;
-    *pByte = temp1;
-}
-
-#endif
-
-// Transports to properly encoded values - note that icc profiles does use
-// big endian notation.
-
-static
-cmsInt32Number TransportValue32(cmsInt32Number Value)
-{
-    cmsInt32Number Temp = Value;
-
-    AdjustEndianess32((cmsUInt8Number*) &Temp);
-    return Temp;
-}
-
 #define SigMake(a,b,c,d) \
                     ( ( ((int) ((unsigned char) (a))) << 24) | \
                       ( ((int) ((unsigned char) (b))) << 16) | \
@@ -784,16 +750,18 @@ static cmsBool _setHeaderInfo(cmsHPROFILE pf, jbyte* pBuffer, jint bufferSize)
   memcpy(&pfHeader, pBuffer, sizeof(cmsICCHeader));
 
   // now set header fields, which we can access using the lcms2 public API
-  cmsSetHeaderFlags(pf, pfHeader.flags);
-  cmsSetHeaderManufacturer(pf, pfHeader.manufacturer);
-  cmsSetHeaderModel(pf, pfHeader.model);
-  cmsSetHeaderAttributes(pf, pfHeader.attributes);
+  cmsSetHeaderFlags(pf, _cmsAdjustEndianess32(pfHeader.flags));
+  cmsSetHeaderManufacturer(pf, _cmsAdjustEndianess32(pfHeader.manufacturer));
+  cmsSetHeaderModel(pf, _cmsAdjustEndianess32(pfHeader.model));
+  cmsUInt64Number attributes;
+  _cmsAdjustEndianess64(&attributes, &pfHeader.attributes);
+  cmsSetHeaderAttributes(pf, attributes);
   cmsSetHeaderProfileID(pf, (cmsUInt8Number*)&(pfHeader.profileID));
-  cmsSetHeaderRenderingIntent(pf, pfHeader.renderingIntent);
-  cmsSetPCS(pf, pfHeader.pcs);
-  cmsSetColorSpace(pf, pfHeader.colorSpace);
-  cmsSetDeviceClass(pf, pfHeader.deviceClass);
-  cmsSetEncodedICCversion(pf, pfHeader.version);
+  cmsSetHeaderRenderingIntent(pf, _cmsAdjustEndianess32(pfHeader.renderingIntent));
+  cmsSetPCS(pf, _cmsAdjustEndianess32(pfHeader.pcs));
+  cmsSetColorSpace(pf, _cmsAdjustEndianess32(pfHeader.colorSpace));
+  cmsSetDeviceClass(pf, _cmsAdjustEndianess32(pfHeader.deviceClass));
+  cmsSetEncodedICCversion(pf, _cmsAdjustEndianess32(pfHeader.version));
 
   return TRUE;
 }

test/jdk/java/awt/color/ICC_Profile/SetHeaderInfo.java

@@ -0,0 +1,85 @@
+/*
+ * Copyright (c) 2021, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.awt.color.ColorSpace;
+import java.awt.color.ICC_Profile;
+import java.util.Arrays;
+
+/**
+ * @test
+ * @bug 8263622
+ * @summary The ICC_Profile#setData invert the order of bytes for the "head" tag
+ */
+public final class SetHeaderInfo {
+
+    public static void main(String[] args) {
+        int[] cspaces = {ColorSpace.CS_sRGB, ColorSpace.CS_LINEAR_RGB,
+                         ColorSpace.CS_CIEXYZ, ColorSpace.CS_PYCC,
+                         ColorSpace.CS_GRAY};
+        for (int cspace : cspaces) {
+            ICC_Profile icc = ICC_Profile.getInstance(cspace);
+            testSame(icc);
+            testCustom(icc);
+            // some corner cases
+            negative(icc, null);
+            negative(icc, new byte[0]);
+            negative(icc, new byte[1]);
+            byte[] header = icc.getData(ICC_Profile.icSigHead);
+            negative(icc, new byte[header.length - 1]);
+        }
+    }
+
+    private static void testSame(ICC_Profile icc) {
+        byte[] expected = icc.getData(ICC_Profile.icSigHead);
+        icc.setData(ICC_Profile.icSigHead, expected);
+        byte[] actual = icc.getData(ICC_Profile.icSigHead);
+        if (!Arrays.equals(expected, actual)) {
+            System.err.println("Expected: " + Arrays.toString(expected));
+            System.err.println("Actual:   " + Arrays.toString(actual));
+            throw new RuntimeException();
+        }
+    }
+
+    private static void testCustom(ICC_Profile icc) {
+        byte[] expected = icc.getData(ICC_Profile.icSigHead);
+        // small modification of the default profile
+        expected[ICC_Profile.icHdrFlags + 3] = 1;
+        expected[ICC_Profile.icHdrModel + 3] = 1;
+        icc.setData(ICC_Profile.icSigHead, expected);
+        byte[] actual = icc.getData(ICC_Profile.icSigHead);
+        if (!Arrays.equals(expected, actual)) {
+            System.err.println("Expected: " + Arrays.toString(expected));
+            System.err.println("Actual:   " + Arrays.toString(actual));
+            throw new RuntimeException();
+        }
+    }
+
+    private static void negative(ICC_Profile icc, byte[] tagData) {
+        try {
+            icc.setData(ICC_Profile.icSigHead, tagData);
+            throw new RuntimeException("IllegalArgumentException expected");
+        } catch (IllegalArgumentException iae) {
+            // expected
+        }
+    }
+}