openjpeg: Prevent a buffer overflow in opj_j2k_read_SQcd_SQcc.

third_party/libopenjpeg20/j2k.c

 /*
  * The copyright in this software is being made available under the 2-clauses 
  * BSD License, included below. This software may be subject to other third 
  * party and contributor rights, including patent rights, and no such rights
  * are granted under this license.
  *
  * Copyright (c) 2002-2014, Universite catholique de Louvain (UCL), Belgium
  * Copyright (c) 2002-2014, Professor Benoit Macq
  * Copyright (c) 2001-2003, David Janssens
  * Copyright (c) 2002-2003, Yannick Verschueren
@@ skipping 8992 matching lines @@
         assert(p_manager != 00);
         assert(p_header_data != 00);
 
         l_cp = &(p_j2k->m_cp);
         /* come from tile part header or main header ?*/
         l_tcp = (p_j2k->m_specific_param.m_decoder.m_state == J2K_STATE_TPH) ? /*FIXME J2K_DEC_STATE_TPH*/
                                 &l_cp->tcps[p_j2k->m_current_tile_number] :
                                 p_j2k->m_specific_param.m_decoder.m_default_tcp;
 
         /* precondition again*/
-        assert(p_comp_no <  p_j2k->m_private_image->numcomps);
+        if (p_comp_no >=  p_j2k->m_private_image->numcomps) {
+            return OPJ_FALSE;
+        }
 
         l_tccp = &l_tcp->tccps[p_comp_no];
         l_current_ptr = p_header_data;
 
         if (*p_header_size < 1) {
                 opj_event_msg(p_manager, EVT_ERROR, "Error reading SQcd or SQcc element\n");
                 return OPJ_FALSE;
         }
         *p_header_size -= 1;
 
@@ skipping 1788 matching lines @@
                         return OPJ_FALSE;
                 }
                 if (! opj_j2k_post_write_tile(p_j2k,p_stream,p_manager)) {
                         opj_event_msg(p_manager, EVT_ERROR, "Error while opj_j2k_post_write_tile with tile index = %d\n", p_tile_index);
                         return OPJ_FALSE;
                 }
         }
 
         return OPJ_TRUE;
 }