iccDEV Null Pointer Dereference Vulnerability in CIccTagXmlStruct::ParseTag() Leading to Segmentation Fault

A null pointer dereference vulnerability has been identified in iccDEV versions prior to 2.3.1.5. The issue occurs in the CIccTagXmlStruct::ParseTag() function, where the absence of proper checks for tag children pointers allows for dereferencing a null pointer. This oversight leads to a segmentation fault, causing a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a segmentation fault, leading to a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by using libFuzzer to fuzz the 'iccFromXml' command-line tool with a specially crafted XML file that triggers the null pointer dereference. The XML file can be obtained from the issue #633 on the iccDEV repository.

Remediation

Users can upgrade to iccDEV version 2.3.1.5 or later, where this vulnerability has been fixed.