openjpeg: Prevent integer overflows during calculation of |l_nb_precinct_size|

third_party/libopenjpeg20/tcd.c

 /*
  * The copyright in this software is being made available under the 2-clauses 
  * BSD License, included below. This software may be subject to other third 
  * party and contributor rights, including patent rights, and no such rights
  * are granted under this license.
  *
  * Copyright (c) 2002-2014, Universite catholique de Louvain (UCL), Belgium
  * Copyright (c) 2002-2014, Professor Benoit Macq
  * Copyright (c) 2001-2003, David Janssens
  * Copyright (c) 2002-2003, Yannick Verschueren
@@ skipping 804 matching lines @@
                         l_tl_prc_x_start = opj_int_floordivpow2(l_res->x0, (OPJ_INT32)l_pdx) << l_pdx;
                         l_tl_prc_y_start = opj_int_floordivpow2(l_res->y0, (OPJ_INT32)l_pdy) << l_pdy;
                         l_br_prc_x_end = opj_int_ceildivpow2(l_res->x1, (OPJ_INT32)l_pdx) << l_pdx;
                         l_br_prc_y_end = opj_int_ceildivpow2(l_res->y1, (OPJ_INT32)l_pdy) << l_pdy;
                         /*fprintf(stderr, "\t\t\tprc_x_start=%d, prc_y_start=%d, br_prc_x_end=%d, br_prc_y_end=%d \n", l_tl_prc_x_start, l_tl_prc_y_start, l_br_prc_x_end ,l_br_prc_y_end );*/
                         
                         l_res->pw = (l_res->x0 == l_res->x1) ? 0 : (OPJ_UINT32)((l_br_prc_x_end - l_tl_prc_x_start) >> l_pdx);
                         l_res->ph = (l_res->y0 == l_res->y1) ? 0 : (OPJ_UINT32)((l_br_prc_y_end - l_tl_prc_y_start) >> l_pdy);
                         /*fprintf(stderr, "\t\t\tres_pw=%d, res_ph=%d\n", l_res->pw, l_res->ph );*/
                         
+                        if (l_res->pw && ((OPJ_UINT32)-1) / l_res->pw < l_res->ph) {
+                                return OPJ_FALSE;
+                        }
                         l_nb_precincts = l_res->pw * l_res->ph;
+
+                        if (((OPJ_UINT32)-1) / (OPJ_UINT32)sizeof(opj_tcd_precinct_t) < l_nb_precincts) {
+                                return OPJ_FALSE;
+                        }
                         l_nb_precinct_size = l_nb_precincts * (OPJ_UINT32)sizeof(opj_tcd_precinct_t);
                         if (resno == 0) {
                                 tlcbgxstart = l_tl_prc_x_start;
                                 tlcbgystart = l_tl_prc_y_start;
                                 /*brcbgxend = l_br_prc_x_end;*/
                                 /* brcbgyend = l_br_prc_y_end;*/
                                 cbgwidthexpn = l_pdx;
                                 cbgheightexpn = l_pdy;
                                 l_res->numbands = 1;
                         }
@@ skipping 1360 matching lines @@
                                 }
                                 break;
                 }
 
                 ++l_img_comp;
                 ++l_tilec;
         }
 
         return OPJ_TRUE;
 }