Research: 0-sig BAcs & EAcs

[xsscx]

Maintainer Summary

2026-08-16 19:59:45 UTC

Issue

Valid 0-sig w/ BAcs Element reported as ELEM_eACS in iccDumpProfile

PoC XML File

<?xml version="1.0" encoding="UTF-8"?>
<IccProfile>
  <Header>
    <PreferredCMMType></PreferredCMMType>
    <ProfileVersion>5.0</ProfileVersion>
    <ProfileDeviceClass>spac</ProfileDeviceClass>
    <DataColourSpace>RGB </DataColourSpace>
    <PCS>XYZ </PCS>
    <CreationDateTime>now</CreationDateTime>
    <ProfileFlags EmbeddedInFile="false" UseWithEmbeddedDataOnly="false"/>
    <DeviceAttributes ReflectiveOrTransparency="reflective" GlossyOrMatte="glossy" MediaPolarity="positive" MediaColour="colour"/>
    <RenderingIntent>Relative</RenderingIntent>
    <PCSIlluminant>
      <XYZNumber X="0.96420288" Y="1.00000000" Z="0.82490540"/>
    </PCSIlluminant>
    <ProfileCreator>ICC </ProfileCreator>
  </Header>
  <Tags>
    <multiLocalizedUnicodeType>
      <TagSignature>desc</TagSignature>
      <LocalizedText LanguageCountry="enUS"><![CDATA[MPE ACS XML round-trip fixture]]></LocalizedText>
    </multiLocalizedUnicodeType>
    <XYZArrayType>
      <TagSignature>wtpt</TagSignature>
      <XYZNumber X="0.96420288" Y="1.00000000" Z="0.82490540"/>
    </XYZArrayType>
    <multiLocalizedUnicodeType>
      <TagSignature>cprt</TagSignature>
      <LocalizedText LanguageCountry="enUS"><![CDATA[Copyright 2026 International Color Consortium]]></LocalizedText>
    </multiLocalizedUnicodeType>
    <multiProcessElementType>
      <TagSignature>A2B0</TagSignature>
      <MultiProcessElements InputChannels="3" OutputChannels="3">
        <BAcsElement InputChannels="3" OutputChannels="3" Signature="bACS">
          00 01 7f ff
        </BAcsElement>
        <EAcsElement InputChannels="3" OutputChannels="3" Signature="eACS">
          12 34 56 78
        </EAcsElement>
      </MultiProcessElements>
    </multiProcessElementType>
    <multiProcessElementType>
      <TagSignature>B2A0</TagSignature>
      <MultiProcessElements InputChannels="3" OutputChannels="3">
        <BAcsElement InputChannels="3" OutputChannels="3" Signature="">
          00 01 7f ff
        </BAcsElement>
        <EAcsElement InputChannels="3" OutputChannels="3" Signature="">
          12 34 56 78
        </EAcsElement>
      </MultiProcessElements>
    </multiProcessElementType>
  </Tags>
</IccProfile>

PoC

iccFromXml acs.xml acs.icc
iccDumpProfile acs.icc ALL | grep -E 'ELEM_[be]ACS|PROCESS_ELEMENT'

Incorrect Output

BEGIN MULTI_PROCESS_ELEMENT_TAG 3 3
PROCESS_ELEMENT #1
ELEM_bACS
PROCESS_ELEMENT #2
ELEM_eACS
END MULTI_PROCESS_ELEMENT_TAG
BEGIN MULTI_PROCESS_ELEMENT_TAG 3 3
PROCESS_ELEMENT #1
ELEM_eACS
PROCESS_ELEMENT #2
ELEM_eACS
END MULTI_PROCESS_ELEMENT_TAG

Expected Output

BEGIN MULTI_PROCESS_ELEMENT_TAG 3 3
PROCESS_ELEMENT #1
ELEM_bACS
PROCESS_ELEMENT #2
ELEM_bACS
END MULTI_PROCESS_ELEMENT_TAG

[github-actions]

Thanks for opening this issue.

The triage bot added initial labels based on the template and issue text. Maintainers may adjust labels as they review scope, reproduction details, CTest/regression needs, and security impact.

If you have questions, contact a listed Maintainer.

[xsscx]

QA Note

2026-08-16 20:29:41 UTC

• Potential XML Reparse
  • When hex is non-zero len
• Then no free() on m_pData
  • and
    • No reset on m_nDataSize