Merge to M44: Upgrade openjpeg to r3002

core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/j2k.c

 /*
  * The copyright in this software is being made available under the 2-clauses 
  * BSD License, included below. This software may be subject to other third 
  * party and contributor rights, including patent rights, and no such rights
  * are granted under this license.
  *
  * Copyright (c) 2002-2014, Universite catholique de Louvain (UCL), Belgium
  * Copyright (c) 2002-2014, Professor Benoit Macq
  * Copyright (c) 2001-2003, David Janssens
  * Copyright (c) 2002-2003, Yannick Verschueren
@@ skipping 2413 matching lines @@
         assert(p_j2k != 00);
         assert(p_manager != 00);
 
         l_image = p_j2k->m_private_image;
         l_cp = &(p_j2k->m_cp);
 
         /* If we are in the first tile-part header of the current tile */
         l_tcp = (p_j2k->m_specific_param.m_decoder.m_state == J2K_STATE_TPH) ?
                                 &l_cp->tcps[p_j2k->m_current_tile_number] :
                                 p_j2k->m_specific_param.m_decoder.m_default_tcp;
-
+        
+        /* Only one COD per tile */
+        if (l_tcp->cod) {
+                opj_event_msg(p_manager, EVT_ERROR, "COD marker already read. No more than one COD marker per tile.\n");
+                return OPJ_FALSE;
+        }
+        l_tcp->cod = 1;
+        
         /* Make sure room is sufficient */
         if (p_header_size < 5) {
                 opj_event_msg(p_manager, EVT_ERROR, "Error reading COD marker\n");
                 return OPJ_FALSE;
         }
 
         opj_read_bytes(p_header_data,&l_tcp->csty,1);           /* Scod */
         ++p_header_data;
         /* Make sure we know how to decode this */
         if ((l_tcp->csty & ~(OPJ_UINT32)(J2K_CP_CSTY_PRT | J2K_CP_CSTY_SOP | J2K_CP_CSTY_EPH)) != 0U) {
                 opj_event_msg(p_manager, EVT_ERROR, "Unknown Scod value in COD marker\n");
                 return OPJ_FALSE;
         }
         opj_read_bytes(p_header_data,&l_tmp,1);                         /* SGcod (A) */
         ++p_header_data;
         l_tcp->prg = (OPJ_PROG_ORDER) l_tmp;
         /* Make sure progression order is valid */
         if (l_tcp->prg > OPJ_CPRL ) {
                 opj_event_msg(p_manager, EVT_ERROR, "Unknown progression order in COD marker\n");
                 l_tcp->prg = OPJ_PROG_UNKNOWN;
         }
         opj_read_bytes(p_header_data,&l_tcp->numlayers,2);      /* SGcod (B) */
         p_header_data+=2;
+        
+        if ((l_tcp->numlayers < 1U) || (l_tcp->numlayers > 65535U)) {
+                opj_event_msg(p_manager, EVT_ERROR, "Invalid number of layers in COD marker : %d not in range [1-65535]\n", l_tcp->numlayers);
+                return OPJ_FALSE;
+        }
 
         /* If user didn't set a number layer to decode take the max specify in the codestream. */
         if      (l_cp->m_specific_param.m_dec.m_layer) {
                 l_tcp->num_layers_to_decode = l_cp->m_specific_param.m_dec.m_layer;
         }
         else {
                 l_tcp->num_layers_to_decode = l_tcp->numlayers;
         }
 
         opj_read_bytes(p_header_data,&l_tcp->mct,1);            /* SGcod (C) */
@@ skipping 4875 matching lines @@
         l_default_tcp = p_j2k->m_specific_param.m_decoder.m_default_tcp;
         l_mct_size = l_image->numcomps * l_image->numcomps * (OPJ_UINT32)sizeof(OPJ_FLOAT32);
 
         /* For each tile */
         for (i=0; i<l_nb_tiles; ++i) {
                 /* keep the tile-compo coding parameters pointer of the current tile coding parameters*/
                 l_current_tccp = l_tcp->tccps;
                 /*Copy default coding parameters into the current tile coding parameters*/
                 memcpy(l_tcp, l_default_tcp, sizeof(opj_tcp_t));
                 /* Initialize some values of the current tile coding parameters*/
+                l_tcp->cod = 0;
                 l_tcp->ppt = 0;
                 l_tcp->ppt_data = 00;
                 /* Remove memory not owned by this tile in case of early error return. */
                 l_tcp->m_mct_decoding_matrix = 00;
                 l_tcp->m_nb_max_mct_records = 0;
                 l_tcp->m_mct_records = 00;
                 l_tcp->m_nb_max_mcc_records = 0;
                 l_tcp->m_mcc_records = 00;
                 /* Reconnect the tile-compo coding parameters pointer to the current tile coding parameters*/
                 l_tcp->tccps = l_current_tccp;
@@ skipping 25 matching lines @@
 
                                 l_dest_mct_rec->m_data = (OPJ_BYTE*) opj_malloc(l_src_mct_rec->m_data_size);
                                 if(! l_dest_mct_rec->m_data) {
                                         return OPJ_FALSE;
                                 }
                                 memcpy(l_dest_mct_rec->m_data,l_src_mct_rec->m_data,l_src_mct_rec->m_data_size);
                         }
 
                         ++l_src_mct_rec;
                         ++l_dest_mct_rec;
-
                         /* Update with each pass to free exactly what has been allocated on early return. */
                         l_tcp->m_nb_max_mct_records += 1;
                 }
 
                 /* Get the mcc_record of the dflt_tile_cp and copy them into the current tile cp*/
                 l_mcc_records_size = l_default_tcp->m_nb_max_mcc_records * (OPJ_UINT32)sizeof(opj_simple_mcc_decorrelation_data_t);
                 l_tcp->m_mcc_records = (opj_simple_mcc_decorrelation_data_t*) opj_malloc(l_mcc_records_size);
                 if (! l_tcp->m_mcc_records) {
                         return OPJ_FALSE;
                 }
@@ skipping 602 matching lines @@
         OPJ_INT32 * l_dest_ptr;
         opj_tcd_resolution_t* l_res= 00;
 
         l_tilec = p_tcd->tcd_image->tiles->comps;
         l_image_src = p_tcd->image;
         l_img_comp_src = l_image_src->comps;
 
         l_img_comp_dest = p_output_image->comps;
 
         for (i=0; i<l_image_src->numcomps; i++) {
+
                 /* Allocate output component buffer if necessary */
                 if (!l_img_comp_dest->data) {
                     OPJ_UINT32 width = l_img_comp_dest->w;
                     OPJ_UINT32 height = l_img_comp_dest->h;
                     const OPJ_UINT32 MAX_SIZE = UINT32_MAX / sizeof(OPJ_INT32);
                     if (height == 0 || width > MAX_SIZE / height) {
                         return OPJ_FALSE;
                     } 
                     l_img_comp_dest->data = (OPJ_INT32*) opj_calloc(width * height, sizeof(OPJ_INT32));
                     if (!l_img_comp_dest->data) {
@@ skipping 599 matching lines @@
         }
 
         opj_read_bytes(l_current_ptr,&l_tccp->cblkw ,1);                /* SPcoc (E) */
         ++l_current_ptr;
         l_tccp->cblkw += 2;
 
         opj_read_bytes(l_current_ptr,&l_tccp->cblkh ,1);                /* SPcoc (F) */
         ++l_current_ptr;
         l_tccp->cblkh += 2;
 
+        if ((l_tccp->cblkw > 10) || (l_tccp->cblkh > 10) || ((l_tccp->cblkw + l_tccp->cblkh) > 12)) {
+                opj_event_msg(p_manager, EVT_ERROR, "Error reading SPCod SPCoc element, Invalid cblkw/cblkh combination\n");
+                return OPJ_FALSE;
+        }
+        
+
         opj_read_bytes(l_current_ptr,&l_tccp->cblksty ,1);              /* SPcoc (G) */
         ++l_current_ptr;
 
         opj_read_bytes(l_current_ptr,&l_tccp->qmfbid ,1);               /* SPcoc (H) */
         ++l_current_ptr;
 
         *p_header_size = *p_header_size - 5;
 
         /* use custom precinct size ? */
         if (l_tccp->csty & J2K_CCP_CSTY_PRT) {
@@ skipping 1938 matching lines @@
                         return OPJ_FALSE;
                 }
                 if (! opj_j2k_post_write_tile(p_j2k,p_stream,p_manager)) {
                         opj_event_msg(p_manager, EVT_ERROR, "Error while opj_j2k_post_write_tile with tile index = %d\n", p_tile_index);
                         return OPJ_FALSE;
                 }
         }
 
         return OPJ_TRUE;
 }