buf_write_ccss() in xicc/ccss.c takes pointer to int parameter (len)
then passes it to get_buf() method while casting it to pointer to size_t.
This breaks at least on x86-64 since on this arch (usually) int is
4-byte long but size_t has a length of 8 bytes.
Due to this mismatch get_buf() can overwrite some other data when
returning buffer length.
It looks like the practical effect of this overwrite on release builds
is that oeminst only writes out first file it founds when
converting i1 DisplayPro / ColorMunki Display calibration files.
Users reports:
//www.freelists.org/post/argyllcms/oeminst-for-new-i1display-pro-fails,6
https://sourceforge.net/p/dispcalgui/discussion/932493/thread/66c13445/
Debug builds segfault instead, however.
Fix this by changing buf_write_ccss() len parameter type to size_t
and adapting its caller accordingly (edr_convert() in spectro/oemarch.c).
Signed-off-by: Maciej S. Szmigiero <mail@xxxxxxxxxxxxxxxxxxxxx>
---
--- a/xicc/ccss.c 2015-10-26 05:17:43.000000000 +0100
+++ b/xicc/ccss.c 2016-03-18 23:16:45.809232330 +0100
@@ -201,7 +201,7 @@
static int buf_write_ccss(
ccss *p,
unsigned char **buf, /* Return allocated buffer */
-int *len /* Return length */
+size_t *len /* Return length */
) {
int rv;
cgats *ocg; /* CGATS structure */
@@ -231,7 +231,7 @@
}
/* Get the buffer the ccss has been written to */
- if (fp->get_buf(fp, buf, (size_t *)len)) {
+ if (fp->get_buf(fp, buf, len)) {
strcpy(p->err, "cgatsFileMem get_buf failed");
return 2;
}
--- a/xicc/ccss.h 2015-10-26 05:17:43.000000000 +0100
+++ b/xicc/ccss.h 2016-03-18 23:17:15.859220716 +0100
@@ -42,7 +42,7 @@
/* write a CGATS .ccss file to a memory buffer. */
/* return nz on error, with message in err[] */
- int (*buf_write_ccss)(struct _ccss *p, unsigned char **buf, int *len);
+ int (*buf_write_ccss)(struct _ccss *p, unsigned char **buf, size_t
*len);
/* read from a CGATS .ccss file */
/* return nz on error, with message in err[] */
--- a/spectro/oemarch.c 2015-10-26 05:17:48.000000000 +0100
+++ b/spectro/oemarch.c 2016-03-18 23:16:08.893704239 +0100
@@ -1407,9 +1407,9 @@
char *ccssname;
char *edrname;
unsigned char *buf;
- int len;
+ size_t len;
if (c->buf_write_ccss(c, &buf, &len)) {
error("Failed to create ccss for '%s' error
'%s'",xi->name,c->err);
}
/* Convert .edr file name to .ccss */
