Fix: divide-by-zero in CIccPcsXform::pushXyzLumToXyz on zero illuminant luminance (#1406)

[colourbill-ctrl]

Fixes #1406.

The defect (UBSan float-divide-by-zero)

When luminance-based PCS matching is requested (the +1000 rendering-intent flag), the CMM inserts an inverse-luminance PCS scale step. CIccPcsXform::pushXyzLumToXyz built that step as:

icFloatNumber scale = 1.0f / XYZLum[1];   // IccCmm.cpp:3048

XYZLum[1] is the destination profile's illuminant luminance (Y), from its connection conditions. A malformed profile can drive it to zero — @xsscx's fuzz PoC carries a spectralViewingConditions (svcn) tag whose IlluminantXYZ is (0,0,0) — so 1.0/0 is a divide by zero. UBSan flags it, and the resulting infinite scale corrupts every PCS sample pushed through pushScale3:

IccCmm.cpp:3048:30: runtime error: division by zero
  in CIccPcsXform::pushXyzLumToXyz(IIccProfileConnectionConditions*)
  #1 pushXYZConvert -> Connect -> CheckPCSConnections -> Begin

Bisected to 3b6089e (Nov 2017).

The fix

Fall back to an identity (1.0) scale when the luminance is not a positive, finite value:

icFloatNumber scale = (std::isfinite(XYZLum[1]) && XYZLum[1] > 0.0f)
                        ? 1.0f / XYZLum[1]
                        : 1.0f;

There is no meaningful luminance normalization to undo for a degenerate illuminant, and a no-op leaves the PCS data intact rather than poisoning it with inf/NaN. std::isfinite matches the existing guard style in this file (e.g. IccCmm.cpp:1489). The sibling forward step pushXyzToXyzLum multiplies by Y and is not a divide, so it has no divide-by-zero exposure.

Regression test

iccdev.issue-1406-roundtrip-xyzlum-dbz replays the committed PoC (.github/ci/test-data/ub-roundtrip-xyzlum-dbz-1406.icc) through iccApplyProfiles with a +1000 luminance intent over the always-present smCows380_5_780.tif:

build	result
master (pre-fix)	FAIL — IccCmm.cpp:3048:30: runtime error: division by zero
this PR	PASS — zero luminance handled, no UB

The float-divide-by-zero check only exists when the tool is built with -fsanitize=float-divide-by-zero (the ci-regression-container build — plain ENABLE_UBSAN does not enable it), so the test gates on the sanitizer in CMakeCache.txt and SKIPS on other builds rather than report a misleading pass — same approach as the #1342/#1343 integer-sanitizer regression.

Verified locally under a -fsanitize=float-divide-by-zero build: FAIL on master, PASS on the fix.

🤖 Generated with Claude Code