Merge to XFA: Fix a dividing zero bug in opj_tcd_init_tile()

third_party/libopenjpeg20/tcd.c

 /*
  * The copyright in this software is being made available under the 2-clauses 
  * BSD License, included below. This software may be subject to other third 
  * party and contributor rights, including patent rights, and no such rights
  * are granted under this license.
  *
  * Copyright (c) 2002-2014, Universite catholique de Louvain (UCL), Belgium
  * Copyright (c) 2002-2014, Professor Benoit Macq
  * Copyright (c) 2001-2003, David Janssens
  * Copyright (c) 2002-2003, Yannick Verschueren
@@ skipping 709 matching lines @@
         /*tile->numcomps = image->numcomps; */
         for (compno = 0; compno < l_tile->numcomps; ++compno) {
                 /*fprintf(stderr, "compno = %d/%d\n", compno, l_tile->numcomps);*/
                 l_image_comp->resno_decoded = 0;
                 /* border of each l_tile component (global) */
                 l_tilec->x0 = opj_int_ceildiv(l_tile->x0, (OPJ_INT32)l_image_comp->dx);
                 l_tilec->y0 = opj_int_ceildiv(l_tile->y0, (OPJ_INT32)l_image_comp->dy);
                 l_tilec->x1 = opj_int_ceildiv(l_tile->x1, (OPJ_INT32)l_image_comp->dx);
                 l_tilec->y1 = opj_int_ceildiv(l_tile->y1, (OPJ_INT32)l_image_comp->dy);
                 /*fprintf(stderr, "\tTile compo border = %d,%d,%d,%d\n", l_tilec->x0, l_tilec->y0,l_tilec->x1,l_tilec->y1);*/
-                
+                if (l_tilec->x0 >= l_tilec->x1 || l_tilec->y0 >= l_tilec->y1) {
+                        opj_event_msg(manager, EVT_ERROR, "Invalid tile data\n");
+                        return OPJ_FALSE;
+                }
                 /* compute l_data_size with overflow check */
                 l_data_size = (OPJ_UINT32)(l_tilec->x1 - l_tilec->x0);
                 if ((((OPJ_UINT32)-1) / l_data_size) < (OPJ_UINT32)(l_tilec->y1 - l_tilec->y0)) {
                         opj_event_msg(manager, EVT_ERROR, "Not enough memory for tile data\n");
                         return OPJ_FALSE;
                 }
                 l_data_size = l_data_size * (OPJ_UINT32)(l_tilec->y1 - l_tilec->y0);
                 
                 if ((((OPJ_UINT32)-1) / (OPJ_UINT32)sizeof(OPJ_UINT32)) < l_data_size) {
                         opj_event_msg(manager, EVT_ERROR, "Not enough memory for tile data\n");
@@ skipping 1452 matching lines @@
                                 }
                                 break;
                 }
 
                 ++l_img_comp;
                 ++l_tilec;
         }
 
         return OPJ_TRUE;
 }