diff --git a/src/cmstypes.c b/src/cmstypes.c index 4f2d2eec..587c717c 100644 --- a/src/cmstypes.c +++ b/src/cmstypes.c @@ -970,14 +970,18 @@ void *Type_Text_Description_Read(struct _cms_typehandler_struct* self, cmsIOHAND if (!_cmsReadUInt32Number(io, &UnicodeCount)) goto Done; SizeOfTag -= 2* sizeof(cmsUInt32Number); - if (SizeOfTag < UnicodeCount*sizeof(cmsUInt16Number)) goto Done; + if (UnicodeCount == 0 || SizeOfTag < UnicodeCount*sizeof(cmsUInt16Number)) goto Done; - UnicodeString = (wchar_t*)_cmsMalloc(self->ContextID, UnicodeCount * sizeof(wchar_t)); + UnicodeString = (wchar_t*)_cmsMalloc(self->ContextID, (UnicodeCount + 1) * sizeof(wchar_t)); if (UnicodeString == NULL) goto Done; if (!_cmsReadWCharArray(io, UnicodeCount, UnicodeString)) goto Done; + + UnicodeString[UnicodeCount] = 0; + if (!cmsMLUsetWide(mlu, cmsV2Unicode, cmsV2Unicode, UnicodeString)) goto Done; _cmsFree(self->ContextID, (void*)UnicodeString); + UnicodeString = NULL; SizeOfTag -= UnicodeCount*sizeof(cmsUInt16Number); @@ -1002,6 +1006,7 @@ void *Type_Text_Description_Read(struct _cms_typehandler_struct* self, cmsIOHAND return mlu; Error: + if (UnicodeString) _cmsFree(self->ContextID, (void*)UnicodeString); if (Text) _cmsFree(self ->ContextID, (void*) Text); if (mlu) cmsMLUfree(mlu); return NULL;