Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mm2/Little-CMS

              master @ cb35a0c
            

Fixes

CVEs

HIGH

Peak severity

58.3%

Coverage

Highlights

Integer Overflow: 6 prior fixes. Scrutinize any change in this area.

src/cmsio0.c: most-fixed (6 issues). Treat as high-risk during review.

22 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Integer Overflow: Multiple fixes target unchecked multiplication (lut_size^3, nPatches*nSamples, InputChans*OutputChans) and exponent parsing, leading to undersized allocations and heap overflows.

Buffer Overflow / Heap Buffer Overflow: Unbounded memmove, strcat/strcpy into fixed buffers, and wrong allocation sizes (Cols vs Rows) cause stack/heap corruption; fixed by bounds checks and larger buffers.

Use-After-Free / Double Free: Pointers not nulled after free and double-unregister of plugins lead to memory corruption; fixes add NULL assignments and move mempool destruction.