Skip to content

[lcms] Fix unused context leak and wrong return value in cms_cgats_fuzzer #15075

@OwenSanzas

Description

@OwenSanzas

Summary

This is not a bug in lcms. It is a bug in cms_cgats_fuzzer with two issues:

  1. Unused context leak: cmsCreateContext called at line 23 but the context is never used or freed
  2. Wrong return value: return 1 on the normal exit path (line 75) instead of return 0

Bug Details

Issue 1: Unused context (P1)

cmsContext context = cmsCreateContext(NULL, (void *)data);  // line 23
// context is NEVER used — all cmsIT8* calls use 0 (NULL/global context):
it8 = cmsIT8Alloc(0);                      // line 32 — uses global context
it8 = cmsIT8LoadFromFile(0, "TEST.IT8");   // line 66 — uses global context
// context is NEVER freed — no cmsDeleteContext anywhere

Issue 2: Wrong return value (P1)

cmsIT8Free(it8);
return 1;  // line 75 — should be return 0

LLVMFuzzerTestOneInput must return 0 per the libFuzzer contract. Non-zero returns are reserved for special semantics (e.g., -1 means "don't add to corpus" in some versions).

Suggested Fix

Remove the unused cmsCreateContext call and change return 1 to return 0.

Coverage Comparison

Version Lines Functions
Original 5.55% 9.78%
Fixed 4.57% 7.44%

Coverage decreased slightly — the removed cmsCreateContext call was contributing dead coverage of context internals, not meaningful testing.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions