8273135: java/awt/color/ICC_ColorSpace/MTTransformReplacedProfile.jav…

…a crashes in liblcms.dylib with NULLSeek+0x7

Reviewed-by: phh
Backport-of: 1017a2c2d7ae99e0076abcfaf5e730fec3cb9c6c

src/java.desktop/share/native/liblcms/cmsio0.c

@@ -1660,7 +1660,7 @@ cmsBool IsTypeSupported(cmsTagDescriptor* TagDescriptor, cmsTagTypeSignature Typ
 void* CMSEXPORT cmsReadTag(cmsHPROFILE hProfile, cmsTagSignature sig)
 {
     _cmsICCPROFILE* Icc = (_cmsICCPROFILE*) hProfile;
-    cmsIOHANDLER* io = Icc ->IOhandler;
+    cmsIOHANDLER* io;
     cmsTagTypeHandler* TypeHandler;
     cmsTagTypeHandler LocalTypeHandler;
     cmsTagDescriptor*  TagDescriptor;
@@ -1705,6 +1705,8 @@ void* CMSEXPORT cmsReadTag(cmsHPROFILE hProfile, cmsTagSignature sig)
 
     if (TagSize < 8) goto Error;
 
+    io = Icc ->IOhandler;
+
     if (io == NULL) { // This is a built-in profile that has been manipulated, abort early
 
         cmsSignalError(Icc->ContextID, cmsERROR_CORRUPTION_DETECTED, "Corrupted built-in profile.");