Merge to XFA: openjpeg: Fix potential bad precno value in opj_pi_next* functions.

third_party/libopenjpeg20/pi.c

 /*
  * The copyright in this software is being made available under the 2-clauses 
  * BSD License, included below. This software may be subject to other third 
  * party and contributor rights, including patent rights, and no such rights
  * are granted under this license.
  *
  * Copyright (c) 2002-2014, Universite catholique de Louvain (UCL), Belgium
  * Copyright (c) 2002-2014, Professor Benoit Macq
  * Copyright (c) 2001-2003, David Janssens
  * Copyright (c) 2002-2003, Yannick Verschueren
@@ skipping 359 matching lines @@
                                         
                                         if ((res->pw==0)||(res->ph==0)) continue;
                                         
                                         if ((trx0==trx1)||(try0==try1)) continue;
                                         
                                         prci = opj_int_floordivpow2(opj_int_ceildiv(pi->x, (OPJ_INT32)(comp->dx << levelno)), (OPJ_INT32)res->pdx)
                                                  - opj_int_floordivpow2(trx0, (OPJ_INT32)res->pdx);
                                         prcj = opj_int_floordivpow2(opj_int_ceildiv(pi->y, (OPJ_INT32)(comp->dy << levelno)), (OPJ_INT32)res->pdy)
                                                  - opj_int_floordivpow2(try0, (OPJ_INT32)res->pdy);
                                         pi->precno = (OPJ_UINT32)(prci + prcj * (OPJ_INT32)res->pw);
+                                        if (pi->precno >= res->pw * res->ph) {
+                                                return OPJ_FALSE;
+                                        }
                                         for (pi->layno = pi->poc.layno0; pi->layno < pi->poc.layno1; pi->layno++) {
                                                 index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno * pi->step_c + pi->precno * pi->step_p;
                                                 if (!pi->include[index]) {
                                                         pi->include[index] = 1;
                                                         return OPJ_TRUE;
                                                 }
 LABEL_SKIP:;
                                         }
                                 }
                         }
@@ skipping 61 matching lines @@
                                         
                                         if ((res->pw==0)||(res->ph==0)) continue;
                                         
                                         if ((trx0==trx1)||(try0==try1)) continue;
                                         
                                         prci = opj_int_floordivpow2(opj_int_ceildiv(pi->x, (OPJ_INT32)(comp->dx << levelno)), (OPJ_INT32)res->pdx)
                                                  - opj_int_floordivpow2(trx0, (OPJ_INT32)res->pdx);
                                         prcj = opj_int_floordivpow2(opj_int_ceildiv(pi->y, (OPJ_INT32)(comp->dy << levelno)), (OPJ_INT32)res->pdy)
                                                  - opj_int_floordivpow2(try0, (OPJ_INT32)res->pdy);
                                         pi->precno = (OPJ_UINT32)(prci + prcj * (OPJ_INT32)res->pw);
+                                        if (pi->precno >= res->pw * res->ph) {
+                                                return OPJ_FALSE;
+                                        }
                                         for (pi->layno = pi->poc.layno0; pi->layno < pi->poc.layno1; pi->layno++) {
                                                 index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno * pi->step_c + pi->precno * pi->step_p;
                                                 if (!pi->include[index]) {
                                                         pi->include[index] = 1;
                                                         return OPJ_TRUE;
                                                 }       
 LABEL_SKIP:;
                                         }
                                 }
                         }
@@ skipping 59 matching lines @@
                                         
                                         if ((res->pw==0)||(res->ph==0)) continue;
                                         
                                         if ((trx0==trx1)||(try0==try1)) continue;
                                         
                                         prci = opj_int_floordivpow2(opj_int_ceildiv(pi->x, (OPJ_INT32)(comp->dx << levelno)), (OPJ_INT32)res->pdx)
                                                  - opj_int_floordivpow2(trx0, (OPJ_INT32)res->pdx);
                                         prcj = opj_int_floordivpow2(opj_int_ceildiv(pi->y, (OPJ_INT32)(comp->dy << levelno)), (OPJ_INT32)res->pdy)
                                                  - opj_int_floordivpow2(try0, (OPJ_INT32)res->pdy);
                                         pi->precno = (OPJ_UINT32)(prci + prcj * (OPJ_INT32)res->pw);
+                                        if (pi->precno >= res->pw * res->ph) {
+                                                return OPJ_FALSE;
+                                        }
                                         for (pi->layno = pi->poc.layno0; pi->layno < pi->poc.layno1; pi->layno++) {
                                                 index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno * pi->step_c + pi->precno * pi->step_p;
                                                 if (!pi->include[index]) {
                                                         pi->include[index] = 1;
                                                         return OPJ_TRUE;
                                                 }
 LABEL_SKIP:;
                                         }
                                 }
                         }
@@ skipping 1325 matching lines @@
                 case OPJ_PCRL:
                         return opj_pi_next_pcrl(pi);
                 case OPJ_CPRL:
                         return opj_pi_next_cprl(pi);
                 case OPJ_PROG_UNKNOWN:
                         return OPJ_FALSE;
         }
         
         return OPJ_FALSE;
 }