openjpeg: Prevent overflows when using opj_aligned_malloc()

third_party/libopenjpeg20/dwt.c

 /*
  * The copyright in this software is being made available under the 2-clauses 
  * BSD License, included below. This software may be subject to other third 
  * party and contributor rights, including patent rights, and no such rights
  * are granted under this license.
  *
  * Copyright (c) 2002-2014, Universite catholique de Louvain (UCL), Belgium
  * Copyright (c) 2002-2014, Professor Benoit Macq
  * Copyright (c) 2001-2003, David Janssens
  * Copyright (c) 2002-2003, Yannick Verschueren
@@ skipping 558 matching lines @@
         opj_dwt_t v;
 
         opj_tcd_resolution_t* tr = tilec->resolutions;
 
         OPJ_UINT32 rw = (OPJ_UINT32)(tr->x1 - tr->x0);  /* width of the resolution level computed */
         OPJ_UINT32 rh = (OPJ_UINT32)(tr->y1 - tr->y0);  /* height of the resolution level computed */
 
         OPJ_UINT32 w = (OPJ_UINT32)(tilec->x1 - tilec->x0);
 
         h.mem_count = opj_dwt_max_resolution(tr, numres);
+        if (((OPJ_UINT32)-1) / (OPJ_UINT32)sizeof(OPJ_INT32) < (OPJ_UINT32)h.mem_count) {
+                return OPJ_FALSE;
+        }
         h.mem = (OPJ_INT32*)opj_aligned_malloc(h.mem_count * sizeof(OPJ_INT32));
         if (! h.mem){
                 /* FIXME event manager error callback */
                 return OPJ_FALSE;
         }
 
         v.mem_count = h.mem_count;
         v.mem = h.mem;
 
         while( --numres) {
@@ skipping 254 matching lines @@
         opj_v4dwt_t h;
         opj_v4dwt_t v;
 
         opj_tcd_resolution_t* res = tilec->resolutions;
 
         OPJ_UINT32 rw = (OPJ_UINT32)(res->x1 - res->x0);        /* width of the resolution level computed */
         OPJ_UINT32 rh = (OPJ_UINT32)(res->y1 - res->y0);        /* height of the resolution level computed */
 
         OPJ_UINT32 w = (OPJ_UINT32)(tilec->x1 - tilec->x0);
 
-        h.wavelet = (opj_v4_t*) opj_aligned_malloc((opj_dwt_max_resolution(res, numres)+5) * sizeof(opj_v4_t));
+        OPJ_UINT32 mr = opj_dwt_max_resolution(res, numres);
+
+        if (mr >= ((OPJ_UINT32)-5)) {
+                return OPJ_FALSE;
+        }
+        mr += 5;
+
+        if (((OPJ_UINT32)-1) / (OPJ_UINT32)sizeof(opj_v4_t) < mr) {
+                return OPJ_FALSE;
+        }
+        h.wavelet = (opj_v4_t*) opj_aligned_malloc(mr * sizeof(opj_v4_t));
         if (!h.wavelet) {
                 /* FIXME event manager error callback */
                 return OPJ_FALSE;
         }
         v.wavelet = h.wavelet;
 
         while( --numres) {
                 OPJ_FLOAT32 * restrict aj = (OPJ_FLOAT32*) tilec->data;
                 OPJ_UINT32 bufsize = (OPJ_UINT32)((tilec->x1 - tilec->x0) * (tilec->y1 - tilec->y0));
                 OPJ_INT32 j;
@@ skipping 65 matching lines @@
 
                         for(k = 0; k < rh; ++k){
                                 memcpy(&aj[k*w], &v.wavelet[k], (size_t)j * sizeof(OPJ_FLOAT32));
                         }
                 }
         }
 
         opj_aligned_free(h.wavelet);
         return OPJ_TRUE;
 }