package/lcms2: patch CVE-2026-41254, CVE-2026-42798

- CVE-2026-41254:
    Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in
    cmslut.c because the overflow check is performed after the
    multiplication.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-41254
 - da6110b1d1
 - e0641b1828

- CVE-2026-42798:
    Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer
    overflow in ParseCube in cmscgats.c.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-42798
 - 6a68601982

(cherry picked from commit c409050184)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>

package/lcms2/0001-Fix-integer-overflow-in-CubeSize.patch

@@ -0,0 +1,28 @@
+From da6110b1d14abc394633a388209abd5ebedd7ab0 Mon Sep 17 00:00:00 2001
+From: Marti Maria <marti.maria@littlecms.com>
+Date: Thu, 19 Feb 2026 09:07:20 +0100
+Subject: [PATCH] Fix integer overflow in CubeSize()
+
+Thanks to @zerojackyi for reporting
+
+CVE: CVE-2026-41254
+Upstream: https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ src/cmslut.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/cmslut.c b/src/cmslut.c
+index 10891486..b2452090 100644
+--- a/src/cmslut.c
++++ b/src/cmslut.c
+@@ -460,7 +460,8 @@ void EvaluateCLUTfloatIn16(const cmsFloat32Number In[], cmsFloat32Number Out[],
+ static
+ cmsUInt32Number CubeSize(const cmsUInt32Number Dims[], cmsUInt32Number b)
+ {
+-    cmsUInt32Number rv, dim;
++    cmsUInt32Number dim;
++    cmsUInt64Number rv;
+ 
+     _cmsAssert(Dims != NULL);
+ 

package/lcms2/0002-check-overflow.patch

@@ -0,0 +1,34 @@
+From e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc Mon Sep 17 00:00:00 2001
+From: Marti Maria <marti.maria@littlecms.com>
+Date: Thu, 12 Mar 2026 22:57:35 +0100
+Subject: [PATCH] check for overflow
+
+Thanks to Guanni Qu for detecting & reporting the issue
+
+CVE: CVE-2026-41254
+Upstream: https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ src/cmslut.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/cmslut.c b/src/cmslut.c
+index a60baf98..65c935fc 100644
+--- a/src/cmslut.c
++++ b/src/cmslut.c
+@@ -468,12 +468,12 @@ cmsUInt32Number CubeSize(const cmsUInt32Number Dims[], cmsUInt32Number b)
+     for (rv = 1; b > 0; b--) {
+ 
+         dim = Dims[b-1];
+-        if (dim <= 1) return 0;  // Error
+-
+-        rv *= dim;
++        if (dim <= 1) return 0;  
+ 
+         // Check for overflow
+         if (rv > UINT_MAX / dim) return 0;
++
++        rv *= dim;
+     }
+ 
+     // Again, prevent overflow

package/lcms2/0003-Fix-for-ParseCube-integer-overflow-in-LUT-allocation.patch

@@ -0,0 +1,38 @@
+From 6a686019825a89b715d16671f18d049523354176 Mon Sep 17 00:00:00 2001
+From: Marti Maria <marti.maria@littlecms.com>
+Date: Thu, 19 Feb 2026 08:48:50 +0100
+Subject: [PATCH] Fix for ParseCube integer overflow in LUT allocation
+
+thanks to @zerojackyi for reporting
+
+
+CVE: CVE-2026-42798
+Upstream: https://github.com/mm2/Little-CMS/commit/6a686019825a89b715d16671f18d049523354176
+[thomas: backport  to 2.16]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ src/cmscgats.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/src/cmscgats.c b/src/cmscgats.c
+index 252db22d..3d819fad 100644
+--- a/src/cmscgats.c
++++ b/src/cmscgats.c
+@@ -3128,7 +3128,16 @@ cmsBool ParseCube(cmsIT8* cube, cmsStage** Shaper, cmsStage** CLUT, char title[]
+ 
+             if (lut_size > 0) {
+ 
+-                int nodes = lut_size * lut_size * lut_size;
++                int nodes;
++                
++                /**
++                * Professional LUT‑generation tools (e.g., Nobe LutBake) list 65×65×65 as their highest supported size.                
++                */
++                if (lut_size > 65)
++                    return SynError(cube, "LUT size '%d' is over maximum of 65", lut_size);
++
++                nodes = lut_size * lut_size * lut_size;
++
+ 
+                 cmsFloat32Number* lut_table = _cmsMalloc(cube->ContextID, nodes * 3 * sizeof(cmsFloat32Number));
+                 if (lut_table == NULL) return FALSE;

package/lcms2/lcms2.mk

@@ -14,6 +14,13 @@ LCMS2_INSTALL_STAGING = YES
 # tiff is only used by tificc sample
 LCMS2_CONF_OPTS = --without-tiff
 
+# 0001-Fix-integer-overflow-in-CubeSize.patch
+# 0002-check-overflow.patch
+LCMS2_IGNORE_CVES += CVE-2026-41254
+
+# 0003-Fix-for-ParseCube-integer-overflow-in-LUT-allocation.patch
+LCMS2_IGNORE_CVES += CVE-2026-42798
+
 ifeq ($(BR2_PACKAGE_JPEG),y)
 LCMS2_CONF_OPTS += --with-jpeg
 LCMS2_DEPENDENCIES += jpeg