Code review of ICC profile security issues documented by PAWG

[dwtza]

Review identified issues missing code coverage. This issue was created during PAWG at the ICC Hong Kong 2025 meeting.

[ChrisCoxArt]

If any issues are related to raw sprintf calls, I'm already working to convert them to snprintf (just to quiet the 3300+ warnings).

[dwtza]

@ChrisCoxArt this to-do is related to a list ICC profile security issues that have been identified PAWG. I've updated the issue to clarify the scope.

[xsscx]

Maintainer Summary

2026-03-26 11:57:22 UTC

During the period from Issue opening to now() there are established datapoints:

iccDEV Maintainers evaluate potential patches via the AST & Call Graphs using Project Tooling.

The design choices:

• Accept that Library Code is Unsafe
• Require all potential bugs to reproduce using project tooling OR
  • Wont Fix
  • Out of Scope

During the period iccDEV Maintainers established AFL & CFL Fuzzing Campaigns including Static & Dynamic Analysis Workflows for Transparency & Reporting.

Proposed: Set this Issue to Close within 14 days to allow for additional Feedback, then Assign to @xsscx for completion:

Publish: AST & Call Graphs for all iccDEV Project Tooling

Educate: Use of Discussions Tab in Repo for examples

Deliver: PAWG API aka libIccTest for Conformance Reporting. Details will be Posted shortly.