openjpeg: Prevent overflows when using opj_aligned_malloc()

third_party/libopenjpeg20/t1.c

 /*
  * The copyright in this software is being made available under the 2-clauses 
  * BSD License, included below. This software may be subject to other third 
  * party and contributor rights, including patent rights, and no such rights
  * are granted under this license.
  *
  * Copyright (c) 2002-2014, Universite catholique de Louvain (UCL), Belgium
  * Copyright (c) 2002-2014, Professor Benoit Macq
  * Copyright (c) 2001-2003, David Janssens
  * Copyright (c) 2002-2003, Yannick Verschueren
@@ skipping 1155 matching lines @@
                 OPJ_UINT32 w,
                 OPJ_UINT32 h)
 {
         OPJ_UINT32 datasize=w * h;
         OPJ_UINT32 flagssize;
 
         /* encoder uses tile buffer, so no need to allocate */
         if (!t1->encoder) {
                 if(datasize > t1->datasize){
                         opj_aligned_free(t1->data);
+                        if (((OPJ_UINT32)-1) / (OPJ_UINT32)sizeof(OPJ_INT32) < datasize) {
+                                return OPJ_FALSE;
+                        }
                         t1->data = (OPJ_INT32*) opj_aligned_malloc(datasize * sizeof(OPJ_INT32));
                         if(!t1->data){
                                 /* FIXME event manager error callback */
                                 return OPJ_FALSE;
                         }
                         t1->datasize=datasize;
                 }
                 memset(t1->data,0,datasize * sizeof(OPJ_INT32));
         }
         t1->flags_stride=w+2;
         flagssize=t1->flags_stride * (h+2);
 
         if(flagssize > t1->flagssize){
                 opj_aligned_free(t1->flags);
+                if (((OPJ_UINT32)-1) / (OPJ_UINT32)sizeof(opj_flag_t) < flagssize) {
+                        return OPJ_FALSE;
+                }
                 t1->flags = (opj_flag_t*) opj_aligned_malloc(flagssize * sizeof(opj_flag_t));
                 if(!t1->flags){
                         /* FIXME event manager error callback */
                         return OPJ_FALSE;
                 }
                 t1->flagssize=flagssize;
         }
         memset(t1->flags,0,flagssize * sizeof(opj_flag_t));
 
         t1->w=w;
@@ skipping 555 matching lines @@
                                 opj_mqc_setcurctx(mqc, opj_t1_getctxno_sc(flag));
                                 v = opj_mqc_decode(mqc) ^ opj_t1_getspb(flag);
                                 *datap = v ? -oneplushalf : oneplushalf;
                                 opj_t1_updateflags(flagsp, v, t1->flags_stride);
                         }
                 }
                 *flagsp |= T1_VISIT;
         }
 }                               /* VSC and  BYPASS by Antonin */
 #endif