From b9b1538f3352f5bea63ad0f991fe4af21e19e1f6 Mon Sep 17 00:00:00 2001
From: =?utf8?q?=C3=98yvind=20Kol=C3=A5s?= <pippin@gimp.org>
Date: Fri, 8 Sep 2017 20:26:47 +0200
Subject: [PATCH] babl: avoid accidental matrix overwrite by long names

.. by increasing the static per space allocation to 512 bytes, these names need
to become shorter - or the name be allocated dynamically. This fixes problems
with parameterized lab / sRGB like TRCs - which yielded really long names.
---
 babl/babl-icc.c   | 1 +
 babl/babl-space.c | 6 +++++-
 babl/babl-space.h | 3 ++-
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/babl/babl-icc.c b/babl/babl-icc.c
index 2682fcd..d6857b2 100644
--- a/babl/babl-icc.c
+++ b/babl/babl-icc.c
@@ -531,6 +531,7 @@ const char *babl_space_to_icc (const Babl *babl, int *ret_length)
     icc_write (s15f16, state->o + 12, space->RGBtoXYZ[5]);
     icc_write (s15f16, state->o + 16, space->RGBtoXYZ[8]);
 
+
     write_trc (state, "rTRC", &space->trc[0]->trc);
 
     if (space->trc[0] == space->trc[1] &&
diff --git a/babl/babl-space.c b/babl/babl-space.c
index 3f0812b..6966aba 100644
--- a/babl/babl-space.c
+++ b/babl/babl-space.c
@@ -110,6 +110,9 @@ static void babl_space_compute_matrices (BablSpace *space)
 #endif
 
   memcpy (space->XYZtoRGB, mat, sizeof (mat));
+
+  babl_matrix_to_float (space->RGBtoXYZ, space->RGBtoXYZf);
+  babl_matrix_to_float (space->XYZtoRGB, space->XYZtoRGBf);
 }
 
 const Babl *
@@ -136,7 +139,6 @@ babl_space_from_rgbxyz_matrix (const char *name,
   static BablSpace space;
   space.instance.class_type = BABL_SPACE;
   space.instance.id         = 0;
-
   space.xr = rx;
   space.yr = gx;
   space.xg = bx;
@@ -181,6 +183,7 @@ babl_space_from_rgbxyz_matrix (const char *name,
   space.RGBtoXYZ[6] = rz;
   space.RGBtoXYZ[7] = gz;
   space.RGBtoXYZ[8] = bz;
+
   babl_matrix_invert (space.RGBtoXYZ, space.XYZtoRGB);
 
   babl_matrix_to_float (space.RGBtoXYZ, space.RGBtoXYZf);
@@ -254,6 +257,7 @@ babl_space_from_chromaticities (const char *name,
   if (name)
     sprintf (space_db[i].name, "%s", name);
   else
+          /* XXX: this can get longer than 256bytes ! */
     sprintf (space_db[i].name, "space-%.4f,%.4f_%.4f,%.4f_%.4f,%.4f_%.4f,%.4f_%s,%s,%s",
              wx,wy,rx,ry,bx,by,gx,gy,babl_get_name (space.trc[0]),
              babl_get_name(space.trc[1]), babl_get_name(space.trc[2]));
diff --git a/babl/babl-space.h b/babl/babl-space.h
index fd7d976..70ed535 100644
--- a/babl/babl-space.h
+++ b/babl/babl-space.h
@@ -44,7 +44,8 @@ typedef struct
   double           pad; // for when the numbers represent a matrix
 
   const Babl      *trc[3];
-  char             name[128];
+  char             name[512]; // XXX: allocate this dynamically instead -
+                              //      or use iccv4 style hashes for name.
   double whitepoint[3]; /* CIE XYZ whitepoint */
 
   double RGBtoXYZ[9]; /* matrices for conversions */
-- 
2.30.2