4 files changed, 25 insertions, 8 deletions
diff --git a/third_party/skcms/src/ICCProfile.c b/third_party/skcms/src/ICCProfile.c
index 8e4acc7017..8448327257 100644
--- a/third_party/skcms/src/ICCProfile.c
+++ b/third_party/skcms/src/ICCProfile.c
@@ -188,7 +188,7 @@ static bool read_curve_para(const uint8_t* buf, uint32_t size,
             curve->parametric.f = read_big_fixed(paraTag->parameters + 24);
             break;
     }
-    return true;
+    return skcms_TransferFunction_isValid(&curve->parametric);
 }
 
 typedef struct {
diff --git a/third_party/skcms/src/TransferFunction.c b/third_party/skcms/src/TransferFunction.c
index c87e0695bd..c32d1204a3 100644
--- a/third_party/skcms/src/TransferFunction.c
+++ b/third_party/skcms/src/TransferFunction.c
@@ -23,6 +23,20 @@ float skcms_TransferFunction_eval(const skcms_TransferFunction* tf, float x) {
                              : powf_(tf->a * x + tf->b, tf->g) + tf->e);
 }
 
+bool skcms_TransferFunction_isValid(const skcms_TransferFunction* tf) {
+    // Reject obviously malformed inputs
+    if (!isfinitef_(tf->a + tf->b + tf->c + tf->d + tf->e + tf->f + tf->g)) {
+        return false;
+    }
+
+    // All of these parameters should be non-negative
+    if (tf->a < 0 || tf->c < 0 || tf->d < 0 || tf->g < 0) {
+        return false;
+    }
+
+    return true;
+}
+
 // TODO: Adjust logic here? This still assumes that purely linear inputs will have D > 1, which
 // we never generate. It also emits inverted linear using the same formulation. Standardize on
 // G == 1 here, too?
@@ -44,21 +58,22 @@ bool skcms_TransferFunction_invert(const skcms_TransferFunction* src, skcms_Tran
     // original - parameters are enclosed in square brackets.
     skcms_TransferFunction tf_inv = { 0, 0, 0, 0, 0, 0, 0 };
 
-    // Reject obviously malformed inputs
-    if (!isfinitef_(src->a + src->b + src->c + src->d + src->e + src->f + src->g)) {
+    // This rejects obviously malformed inputs, as well as decreasing functions
+    if (!skcms_TransferFunction_isValid(src)) {
         return false;
     }
 
+    // There are additional constraints to be invertible
     bool has_nonlinear = (src->d <= 1);
     bool has_linear = (src->d > 0);
 
-    // Is the linear section decreasing or not invertible?
-    if (has_linear && src->c <= 0) {
+    // Is the linear section not invertible?
+    if (has_linear && src->c == 0) {
         return false;
     }
 
-    // Is the nonlinear section decreasing or not invertible?
-    if (has_nonlinear && (src->a <= 0 || src->g <= 0)) {
+    // Is the nonlinear section not invertible?
+    if (has_nonlinear && (src->a == 0 || src->g == 0)) {
         return false;
     }
 
diff --git a/third_party/skcms/src/TransferFunction.h b/third_party/skcms/src/TransferFunction.h
index 6a36f81abd..1f32831db4 100644
--- a/third_party/skcms/src/TransferFunction.h
+++ b/third_party/skcms/src/TransferFunction.h
@@ -11,6 +11,8 @@
 
 #include <stdbool.h>
 
+bool skcms_TransferFunction_isValid(const skcms_TransferFunction*);
+
 float skcms_TransferFunction_eval(const skcms_TransferFunction*, float);
 
 bool skcms_TransferFunction_invert(const skcms_TransferFunction*, skcms_TransferFunction*);
diff --git a/third_party/skcms/version.sha1 b/third_party/skcms/version.sha1
index b78dbac96f..f4f6396aa8 100755
--- a/third_party/skcms/version.sha1
+++ b/third_party/skcms/version.sha1
@@ -1 +1 @@
-e19e9b9418405e14169a6e4e500150432fcc57c4
-\ No newline at end of file
+289a2a73aa2642075105c699bac996cb34c65661
+\ No newline at end of file