Fix a crashier due to images with abnormal size

core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/j2k.c

 /*
  * The copyright in this software is being made available under the 2-clauses 
  * BSD License, included below. This software may be subject to other third 
  * party and contributor rights, including patent rights, and no such rights
  * are granted under this license.
  *
  * Copyright (c) 2002-2014, Universite catholique de Louvain (UCL), Belgium
  * Copyright (c) 2002-2014, Professor Benoit Macq
  * Copyright (c) 2001-2003, David Janssens
  * Copyright (c) 2002-2003, Yannick Verschueren
@@ skipping 7990 matching lines @@
         OPJ_INT32 * l_dest_ptr;
         opj_tcd_resolution_t* l_res= 00;
 
         l_tilec = p_tcd->tcd_image->tiles->comps;
         l_image_src = p_tcd->image;
         l_img_comp_src = l_image_src->comps;
 
         l_img_comp_dest = p_output_image->comps;
 
         for (i=0; i<l_image_src->numcomps; i++) {
-
                 /* Allocate output component buffer if necessary */
                 if (!l_img_comp_dest->data) {
-
-                        l_img_comp_dest->data = (OPJ_INT32*) opj_calloc(l_img_comp_dest->w * l_img_comp_dest->h, sizeof(OPJ_INT32));
-                        if (! l_img_comp_dest->data) {
-                                return OPJ_FALSE;
-                        }
+                    OPJ_UINT32 width = l_img_comp_dest->w;
+                    OPJ_UINT32 height = l_img_comp_dest->h;
+                    const OPJ_UINT32 MAX_SIZE = UINT32_MAX / sizeof(OPJ_INT32);
+                    if (height == 0 || width > MAX_SIZE / height) {
+                        return OPJ_FALSE;
+                    } 
+                    l_img_comp_dest->data = (OPJ_INT32*) opj_calloc(width * height, sizeof(OPJ_INT32));
+                    if (!l_img_comp_dest->data) {
+                        return OPJ_FALSE;
+                    }
                 }
 
                 /* Copy info from decoded comp image to output image */
                 l_img_comp_dest->resno_decoded = l_img_comp_src->resno_decoded;
 
                 /*-----*/
                 /* Compute the precision of the output buffer */
                 l_size_comp = l_img_comp_src->prec >> 3; /*(/ 8)*/
                 l_remaining = l_img_comp_src->prec & 7;  /* (%8) */
                 l_res = l_tilec->resolutions + l_img_comp_src->resno_decoded;
@@ skipping 2545 matching lines @@
                         return OPJ_FALSE;
                 }
                 if (! opj_j2k_post_write_tile(p_j2k,p_stream,p_manager)) {
                         opj_event_msg(p_manager, EVT_ERROR, "Error while opj_j2k_post_write_tile with tile index = %d\n", p_tile_index);
                         return OPJ_FALSE;
                 }
         }
 
         return OPJ_TRUE;
 }