Fixed potential read-out-of-bounds issue in ICC profile loading

src/core/SkColorSpace_ICC.cpp

 /*
  * Copyright 2016 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkColorSpace.h"
 #include "SkColorSpace_A2B.h"
 #include "SkColorSpace_Base.h"
@@ skipping 638 matching lines @@
 
     // Movable struct colorLUT has ownership of fTable.
     void* memory = sk_malloc_throw(sizeof(SkColorLookUpTable) + sizeof(float) * numEntries);
     *colorLUT = sk_sp<SkColorLookUpTable>(new (memory) SkColorLookUpTable(inputChannels,
                                                                           gridPoints));
 
     float* table = SkTAddOffset<float>(memory, sizeof(SkColorLookUpTable));
     const uint8_t* ptr = src + kColorLUTHeaderSize;
     for (uint32_t i = 0; i < numEntries; i++, ptr += precision) {
         if (1 == precision) {
-            table[i] = ((float) ptr[i]) / 255.0f;
+            table[i] = ((float) *ptr) / 255.0f;
         } else {
             table[i] = ((float) read_big_endian_u16(ptr)) / 65535.0f;
         }
     }
 
     return true;
 }
 
 static bool load_matrix(SkMatrix44* toXYZ, const uint8_t* src, size_t len) {
     if (len < 48) {
@@ skipping 678 matching lines @@
     ptr32[4] = SkEndian_SwapBE32(0x000116cc);
     ptr += kTAG_XYZ_Bytes;
 
     // Write copyright tag
     memcpy(ptr, gEmptyTextTag, sizeof(gEmptyTextTag));
 
     // TODO (msarett): Should we try to hold onto the data so we can return immediately if
     //                 the client calls again?
     return SkData::MakeFromMalloc(profile.release(), kICCProfileSize);
 }