iccDEV Type Confusion Vulnerability in Color Profile Processing

A type confusion vulnerability has been identified in the iccDEV library, specifically in versions prior to 2.3.1.2. The issue arises in the 'SIccCalcOp::ArgsPushed()' function within 'IccProfLib/IccMpeCalc.cpp'. This vulnerability affects users who process International Color Consortium (ICC) color profiles, potentially leading to undefined behavior such as signed integer overflow.

Impact

Exploitation of this vulnerability causes a type confusion error, which can lead to undefined behavior in the application, including the possibility of memory corruption.

Reproduction

The vulnerability can be reproduced by using the 'iccFromXml' command with a crafted XML file that triggers the type confusion in the 'SIccCalcOp::ArgsPushed()' function. This can be done by manipulating the input to exceed the expected argument sizes, causing a signed integer overflow.

Remediation

Users can upgrade to iccDEV version 2.3.1.2 or later, where this vulnerability has been patched.