Fix CVE-2016-10165, an out-of-bounds heap read in Type_MLU_Read():

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10165
http://seclists.org/oss-sec/2016/q3/288
https://bugzilla.redhat.com/show_bug.cgi?id=1367357
https://security-tracker.debian.org/tracker/CVE-2016-10165

Patch copied from upstream source repository:

https://github.com/mm2/Little-CMS/commit/5ca71a7bc18b6897ab21d815d15e218e204581e2

From 5ca71a7bc18b6897ab21d815d15e218e204581e2 Mon Sep 17 00:00:00 2001
From: Marti <marti.maria@tktbrainpower.com>
Date: Mon, 15 Aug 2016 23:31:39 +0200
Subject: [PATCH] Added an extra check to MLU bounds

Thanks to Ibrahim el-sayed for spotting the bug
---
 src/cmstypes.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/cmstypes.c b/src/cmstypes.c
index cb61860..c7328b9 100644
--- a/src/cmstypes.c
+++ b/src/cmstypes.c
@@ -1460,6 +1460,7 @@ void *Type_MLU_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* io, cmsU
 
         // Check for overflow
         if (Offset < (SizeOfHeader + 8)) goto Error;
+        if ((Offset + Len) > SizeOfTag + 8) goto Error;
 
         // True begin of the string
         BeginOfThisString = Offset - SizeOfHeader - 8;
-- 
2.11.0

ref='/guix/log/gnu/tests/security-token.scm'>log</a><a href='/guix/tree/gnu/tests/security-token.scm?id=5d08c05d22369ff405a47b0681b37c05a550a6c8'>tree</a><a href='/guix/commit/gnu/tests/security-token.scm?id=5d08c05d22369ff405a47b0681b37c05a550a6c8'>commit</a><a href='/guix/diff/gnu/tests/security-token.scm?id=5d08c05d22369ff405a47b0681b37c05a550a6c8'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/gnu/tests/security-token.scm'>
<input type='hidden' name='id' value='5d08c05d22369ff405a47b0681b37c05a550a6c8'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=5d08c05d22369ff405a47b0681b37c05a550a6c8'>root</a>/<a href='/guix/log/gnu?id=5d08c05d22369ff405a47b0681b37c05a550a6c8'>gnu</a>/<a href='/guix/log/gnu/tests?id=5d08c05d22369ff405a47b0681b37c05a550a6c8'>tests</a>/<a href='/guix/log/gnu/tests/security-token.scm?id=5d08c05d22369ff405a47b0681b37c05a550a6c8'>security-token.scm</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/gnu/tests/security-token.scm?id=5d08c05d22369ff405a47b0681b37c05a550a6c8&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2023-05-06 17:12:45 +0200'>2023-05-06</span></td><td><a href='/guix/commit/gnu/tests/security-token.scm?id=f51888272558d98cf5c196b93fb6c499056fbf6c'>tests: Add missing module imports for marionette-evaluated code.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2021-09-26 23:20:56 +0200'>2021-09-26</span></td><td><a href='/guix/commit/gnu/tests/security-token.scm?id=89b05442933d92f4b21c3294455a498e8333727d'>tests: Reduce boilerplate for users of 'system-test-runner'.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2021-09-25 18:52:05 +0200'>2021-09-25</span></td><td><a href='/guix/commit/gnu/tests/security-token.scm?id=1fb75128a5202b406622da6272bc809c46d1f439'>tests: Adjust to SRFI-64 as found in Guile 3.0.7.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>