UB runtime error: member call at IccProfLib/IccMpeBasic.cpp#L4051

[xsscx]

Maintainer Repro

Wed Dec 31 07:47:19 PM UTC 2025

git rev-parse HEAD && git show --no-patch --oneline
b656e80
b656e80 (HEAD -> master, origin/master, origin/HEAD) Add: Defense in Depth (#385)

PoC iccFromXml NPD-CIccToneMapFunc-Write.icc.txt foo.bar

Expected Output

/home/xss/head/iccDEV/IccProfLib/IccMpeBasic.cpp:4051:23: runtime error: member call on null pointer of type 'CIccToneMapFunc *'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior IccProfLib/IccMpeBasic.cpp:4051:23

NPD-CIccToneMapFunc-Write.icc.txt

[ChrisCoxArt]

m_nOutputChannels is 3, but m_pToneFuncs is a bad pointer.
Fails on i==2. funcs 0 and 1 are duplicates, but 2 is definitely null.
In IccMPEXml.cpp there is an error message for not enough tone functions, but no error returned.
Same for the Luminance Curve - and it is dereferenced without any checks.
Looks like we need to return an error when reading bad XML, and when the pointers are null when trying to write.
The code already has similar checking for NULL when trying to initialize and use the tonemapping function.