QA Report: Omitted measurement Reserved attribute inherits prior state

[xsscx]

QA Report

2026-09-05 00:11:36 UTC

PoC

<?xml version="1.0" encoding="UTF-8"?>
<IccProfile>
  <Header>
    <PreferredCMMType>ICCD</PreferredCMMType>
    <ProfileVersion>2.10</ProfileVersion>
    <ProfileDeviceClass>mntr</ProfileDeviceClass>
    <DataColourSpace>GRAY</DataColourSpace>
    <PCS>XYZ </PCS>
    <CreationDateTime>2026-08-20T00:00:00</CreationDateTime>
    <ProfileFlags EmbeddedInFile="false" UseWithEmbeddedDataOnly="false"/>
    <DeviceAttributes ReflectiveOrTransparency="reflective" GlossyOrMatte="glossy" MediaPolarity="positive" MediaColour="colour"/>
    <RenderingIntent>Perceptual</RenderingIntent>
    <PCSIlluminant>
      <XYZNumber X="0.964202880859" Y="1.000000000000" Z="0.824905395508"/>
    </PCSIlluminant>
    <ProfileCreator>ICCD</ProfileCreator>
  </Header>
  <Tags>
    <grayTRCTag> <curveType>
      <Curve>563</Curve>
    </curveType> </grayTRCTag>
    <profileDescriptionTag> <textDescriptionType>
      <TextData>iccFromXml response reserved state PoC</TextData>
    </textDescriptionType> </profileDescriptionTag>
    <copyrightTag> <textType>
      <TextData>ICC security research fixture</TextData>
    </textType> </copyrightTag>
    <mediaWhitePointTag> <XYZArrayType>
      <XYZNumber X="0.964202880859" Y="1.000000000000" Z="0.824905395508"/>
    </XYZArrayType> </mediaWhitePointTag>
    <responseCurveSet16Type>
      <TagSignature>resp</TagSignature>
      <CountOfChannels>1</CountOfChannels>
      <ResponseCurve MeasUnitSignature="Status A">
        <ChannelResponses X="0" Y="0" Z="0">
          <Measurement DeviceCode="1" MeasValue="0" Reserved="7"/>
          <Measurement DeviceCode="2" MeasValue="0"/>
        </ChannelResponses>
      </ResponseCurve>
    </responseCurveSet16Type>
  </Tags>
</IccProfile>

Bad Breadcrumb

Profile parsed and saved correctly

Issue

Observed: iccFromXml reports Profile parsed and saved correctly and exits 0. iccToXml reports Unable to read and exits 1. iccDumpProfile ... ALL also reports Tag ('resp' = 72657370) not found in profile.

Root cause: CIccTagResponseCurveSet16::Read() first correctly checks the tag-relative nOffset[i] + 4 against the tag-relative size, then computes the absolute offsetCalc = startPos + nOffset[i] and incorrectly compares that
absolute file position with the tag-relative size at IccProfLib/IccTagBasic.cpp:11498. A normal tag at file offset 400 with size 52 and curve offset 16 is rejected because 416 is greater than 52.

[github-actions]

Thanks for opening this issue.

The triage bot added initial labels based on the template and issue text. Maintainers may adjust labels as they review scope, reproduction details, CTest/regression needs, and security impact.

If you have questions, contact a listed Maintainer.