openjpeg: Prevent a buffer overflow in opj_j2k_read_SPCod_SPCoc.

third_party/libopenjpeg20/j2k.c

 /*
  * The copyright in this software is being made available under the 2-clauses 
  * BSD License, included below. This software may be subject to other third 
  * party and contributor rights, including patent rights, and no such rights
  * are granted under this license.
  *
  * Copyright (c) 2002-2014, Universite catholique de Louvain (UCL), Belgium
  * Copyright (c) 2002-2014, Professor Benoit Macq
  * Copyright (c) 2001-2003, David Janssens
  * Copyright (c) 2002-2003, Yannick Verschueren
@@ skipping 8726 matching lines @@
         assert(p_j2k != 00);
         assert(p_manager != 00);
         assert(p_header_data != 00);
 
         l_cp = &(p_j2k->m_cp);
         l_tcp = (p_j2k->m_specific_param.m_decoder.m_state == J2K_STATE_TPH) ?
                                 &l_cp->tcps[p_j2k->m_current_tile_number] :
                                 p_j2k->m_specific_param.m_decoder.m_default_tcp;
 
         /* precondition again */
-        assert(compno < p_j2k->m_private_image->numcomps);
+        if (compno >= p_j2k->m_private_image->numcomps) {
+                return OPJ_FALSE;
+        }
 
         l_tccp = &l_tcp->tccps[compno];
         l_current_ptr = p_header_data;
 
         /* make sure room is sufficient */
         if (*p_header_size < 5) {
                 opj_event_msg(p_manager, EVT_ERROR, "Error reading SPCod SPCoc element\n");
                 return OPJ_FALSE;
         }
 
@@ skipping 2052 matching lines @@
                         return OPJ_FALSE;
                 }
                 if (! opj_j2k_post_write_tile(p_j2k,p_stream,p_manager)) {
                         opj_event_msg(p_manager, EVT_ERROR, "Error while opj_j2k_post_write_tile with tile index = %d\n", p_tile_index);
                         return OPJ_FALSE;
                 }
         }
 
         return OPJ_TRUE;
 }