openjpeg: Prevent integer overflows during calculation of |l_nb_code_blocks_size|

third_party/libopenjpeg20/tcd.c

 /*
  * The copyright in this software is being made available under the 2-clauses 
  * BSD License, included below. This software may be subject to other third 
  * party and contributor rights, including patent rights, and no such rights
  * are granted under this license.
  *
  * Copyright (c) 2002-2014, Universite catholique de Louvain (UCL), Belgium
  * Copyright (c) 2002-2014, Professor Benoit Macq
  * Copyright (c) 2001-2003, David Janssens
  * Copyright (c) 2002-2003, Yannick Verschueren
@@ skipping 921 matching lines @@
                                         /*fprintf(stderr, "\t tlcblkxstart =%d\n",tlcblkxstart );*/
                                         tlcblkystart = opj_int_floordivpow2(l_current_precinct->y0, (OPJ_INT32)cblkheightexpn) << cblkheightexpn;
                                         /*fprintf(stderr, "\t tlcblkystart =%d\n",tlcblkystart );*/
                                         brcblkxend = opj_int_ceildivpow2(l_current_precinct->x1, (OPJ_INT32)cblkwidthexpn) << cblkwidthexpn;
                                         /*fprintf(stderr, "\t brcblkxend =%d\n",brcblkxend );*/
                                         brcblkyend = opj_int_ceildivpow2(l_current_precinct->y1, (OPJ_INT32)cblkheightexpn) << cblkheightexpn;
                                         /*fprintf(stderr, "\t brcblkyend =%d\n",brcblkyend );*/
                                         l_current_precinct->cw = (OPJ_UINT32)((brcblkxend - tlcblkxstart) >> cblkwidthexpn);
                                         l_current_precinct->ch = (OPJ_UINT32)((brcblkyend - tlcblkystart) >> cblkheightexpn);
                                         
+                                        if (l_current_precinct->cw && ((OPJ_UINT32)-1) / l_current_precinct->cw < l_current_precinct->ch) {
+                                                return OPJ_FALSE;
+                                        }
                                         l_nb_code_blocks = l_current_precinct->cw * l_current_precinct->ch;
                                         /*fprintf(stderr, "\t\t\t\t precinct_cw = %d x recinct_ch = %d\n",l_current_precinct->cw, l_current_precinct->ch);      */
+                                        
+                                        if (((OPJ_UINT32)-1) / (OPJ_UINT32)sizeof_block < l_nb_code_blocks) {
+                                                return OPJ_FALSE;
+                                        }
                                         l_nb_code_blocks_size = l_nb_code_blocks * (OPJ_UINT32)sizeof_block;
                                         
                                         if (! l_current_precinct->cblks.blocks) {
                                                 l_current_precinct->cblks.blocks = opj_malloc(l_nb_code_blocks_size);
                                                 if (! l_current_precinct->cblks.blocks ) {
                                                         return OPJ_FALSE;
                                                 }
                                                 /*fprintf(stderr, "\t\t\t\tAllocate cblks of a precinct (opj_tcd_cblk_dec_t): %d\n",l_nb_code_blocks_size);*/
                                                 
                                                 memset(l_current_precinct->cblks.blocks,0,l_nb_code_blocks_size);
@@ skipping 1261 matching lines @@
                                 }
                                 break;
                 }
 
                 ++l_img_comp;
                 ++l_tilec;
         }
 
         return OPJ_TRUE;
 }