openjpeg: Prevent overflows when using opj_aligned_malloc()

third_party/libopenjpeg20/t1.c

Index: third_party/libopenjpeg20/t1.c
diff --git a/third_party/libopenjpeg20/t1.c b/third_party/libopenjpeg20/t1.c
index 108ce78b603ca9eac60b533ec4386f91077135cc..a119db1f76374dc0a508ed9f0ee8803bdf9df515 100644
--- a/third_party/libopenjpeg20/t1.c
+++ b/third_party/libopenjpeg20/t1.c
@@ -1173,6 +1173,9 @@ static OPJ_BOOL opj_t1_allocate_buffers(
 	if (!t1->encoder) {
 		if(datasize > t1->datasize){
 			opj_aligned_free(t1->data);
+			if (((OPJ_UINT32)-1) / (OPJ_UINT32)sizeof(OPJ_INT32) < datasize) {
+				return OPJ_FALSE;
+			}
 			t1->data = (OPJ_INT32*) opj_aligned_malloc(datasize * sizeof(OPJ_INT32));
 			if(!t1->data){
 				/* FIXME event manager error callback */
@@ -1187,6 +1190,9 @@ static OPJ_BOOL opj_t1_allocate_buffers(
 
 	if(flagssize > t1->flagssize){
 		opj_aligned_free(t1->flags);
+		if (((OPJ_UINT32)-1) / (OPJ_UINT32)sizeof(opj_flag_t) < flagssize) {
+			return OPJ_FALSE;
+		}
 		t1->flags = (opj_flag_t*) opj_aligned_malloc(flagssize * sizeof(opj_flag_t));
 		if(!t1->flags){
 			/* FIXME event manager error callback */