Merge to M44: Fix an integer overflow issue in openJpeg

core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/pi.c

 /*
  * The copyright in this software is being made available under the 2-clauses 
  * BSD License, included below. This software may be subject to other third 
  * party and contributor rights, including patent rights, and no such rights
  * are granted under this license.
  *
  * Copyright (c) 2002-2014, Universite catholique de Louvain (UCL), Belgium
  * Copyright (c) 2002-2014, Professor Benoit Macq
  * Copyright (c) 2001-2003, David Janssens
  * Copyright (c) 2002-2003, Yannick Verschueren
@@ skipping 18 matching lines @@
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include <limits.h>
 #include "opj_includes.h"
 
 /** @defgroup PI PI - Implementation of a packet iterator */
 /*@{*/
 
 /** @name Local static functions */
 /*@{*/
 
 /**
 Get next packet in layer-resolution-component-precinct order.
@@ skipping 1180 matching lines @@
         /* step calculations */
         l_step_p = 1;
         l_step_c = l_max_prec * l_step_p;
         l_step_r = p_image->numcomps * l_step_c;
         l_step_l = l_max_res * l_step_r;
 
         /* set values for first packet iterator */
         l_current_pi = l_pi;
 
         /* memory allocation for include */
-        l_current_pi->include = (OPJ_INT16*) opj_calloc((l_tcp->numlayers +1) * l_step_l, sizeof(OPJ_INT16));
+        l_current_pi->include = 00;
+        if
+                (l_step_l && l_tcp->numlayers < UINT_MAX / l_step_l - 1)
+        {
+                l_current_pi->include = (OPJ_INT16*) opj_calloc((l_tcp->numlayers + 1) * l_step_l, sizeof(OPJ_INT16));
+        }
+
         if
                 (!l_current_pi->include)
         {
                 opj_free(l_tmp_data);
                 opj_free(l_tmp_ptr);
                 opj_pi_destroy(l_pi, l_bound);
                 return 00;
         }
 
         /* special treatment for the first packet iterator */
@@ skipping 618 matching lines @@
                 case OPJ_PCRL:
                         return opj_pi_next_pcrl(pi);
                 case OPJ_CPRL:
                         return opj_pi_next_cprl(pi);
                 case OPJ_PROG_UNKNOWN:
                         return OPJ_FALSE;
         }
         
         return OPJ_FALSE;
 }