This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Upgrading LCMS first, but I don't think this has been resolved in their latest version.

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/175a8588f4290df8ec32d697c0248eb5c6b2c396

commit 175a8588f4290df8ec32d697c0248eb5c6b2c396
Author: Nicolas Pena <npm@chromium.org>
Date: Fri Aug 25 18:03:45 2017

Do not QuickFloor on cmsintrp

In this CL, the flag CMS_DONT_USE_FAST_FLOOR is set to true because quickfloor
could cause heap-buffer-overflow due to flooring errors. In the testcase for
the bug, Input[2] is a number very close but smaller than 1 such that
quickfloor returned 1 (whereas Input[2] >= 1.0 was false).

Bug:  chromium:752725 
Change-Id: Ibb1763aa120a600e86602f1a46c4cd6d0d6bebd5
Reviewed-on: https://pdfium-review.googlesource.com/11310
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Nicolás Peña <npm@chromium.org>

[modify] https://crrev.com/175a8588f4290df8ec32d697c0248eb5c6b2c396/third_party/lcms/README.pdfium
[modify] https://crrev.com/175a8588f4290df8ec32d697c0248eb5c6b2c396/third_party/lcms/include/lcms2.h
[add] https://crrev.com/175a8588f4290df8ec32d697c0248eb5c6b2c396/third_party/lcms/0028-do-not-quickfloor.patch

ClusterFuzz has detected this issue as fixed in range 497463:497522.

Detailed report: https://clusterfuzz.com/testcase?key=6362002812567552

Fuzzer: libFuzzer_pdf_codec_icc_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Heap-buffer-overflow READ 4
Crash Address: 0x608000002c80
Crash State:
  TetrahedralInterpFloat
  _LUTeval16
  PrecalculatedXFORM
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=420440:420580
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=497463:497522

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6362002812567552

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6362002812567552 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot