UB at IccUtilXml.cpp:1539

[xsscx]

Maintainer Repro

Wed Mar 25 23:24:00 UTC 2026

Thank you Imaging-Art-Beyond-RGB-Project and SS, PN, RM, JG-S & NM from RIT for the Reports!

Git

9e0b03c (HEAD -> master, origin/master, origin/HEAD) Fix: ci-build-matrix (#714)

Step 1. curl -O https://xss.cx/2026/03/25/img/BeyondRGB_CM_1774467526.tiff

Step 2. iccTiffDump BeyondRGB_CM_1774467526.tiff BeyondRGB_CM_1774467526.tiff.icc

Step 3. iccToXml BeyondRGB_CM_1774467526.tiff.icc foo.bar

PoC Output

curl -O https://xss.cx/2026/03/25/img/BeyondRGB_CM_1774467526.tiff
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  242M  100  242M    0     0  3734k      0  0:01:06  0:01:06 --:--:-- 3700k
...
IccUtilXml.cpp:1539:31: runtime error: implicit conversion from type 'int' of value -12 (32-bit, signed) to type 'icUInt32Number' (aka 'unsigned int') changed the value to 4294967284 (32-bit, unsigned)
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior IccUtilXml.cpp:1539:31

[ChrisCoxArt]

Using #defines, they default to int, but we combine them, negate, and assign to a uint32