openjpeg: Prevent negative x, y values in opj_tcd_init_tile

third_party/libopenjpeg20/tcd.c

 /*
  * The copyright in this software is being made available under the 2-clauses 
  * BSD License, included below. This software may be subject to other third 
  * party and contributor rights, including patent rights, and no such rights
  * are granted under this license.
  *
  * Copyright (c) 2002-2014, Universite catholique de Louvain (UCL), Belgium
  * Copyright (c) 2002-2014, Professor Benoit Macq
  * Copyright (c) 2001-2003, David Janssens
  * Copyright (c) 2002-2003, Yannick Verschueren
@@ skipping 688 matching lines @@
         l_image_comp = p_tcd->image->comps;
         
         p = p_tile_no % l_cp->tw;       /* tile coordinates */
         q = p_tile_no / l_cp->tw;
         /*fprintf(stderr, "Tile coordinate = %d,%d\n", p, q);*/
         
         /* 4 borders of the tile rescale on the image if necessary */
         l_tx0 = l_cp->tx0 + p * l_cp->tdx; /* can't be greater than l_image->x1 so won't overflow */
         l_tile->x0 = (OPJ_INT32)opj_uint_max(l_tx0, l_image->x0);
         l_tile->x1 = (OPJ_INT32)opj_uint_min(opj_uint_adds(l_tx0, l_cp->tdx), l_image->x1);
+        if (l_tile->x0 < 0 || l_tile->x1 < 0) {
+                return OPJ_FALSE;
+        }
+
         l_ty0 = l_cp->ty0 + q * l_cp->tdy; /* can't be greater than l_image->y1 so won't overflow */
         l_tile->y0 = (OPJ_INT32)opj_uint_max(l_ty0, l_image->y0);
         l_tile->y1 = (OPJ_INT32)opj_uint_min(opj_uint_adds(l_ty0, l_cp->tdy), l_image->y1);
+        if (l_tile->y0 < 0 || l_tile->y1 < 0) {
+                return OPJ_FALSE;
+        }
 
         /* testcase 1888.pdf.asan.35.988 */
         if (l_tccp->numresolutions == 0) {
                 opj_event_msg(manager, EVT_ERROR, "tiles require at least one resolution\n");
                 return OPJ_FALSE;
         }
         /*fprintf(stderr, "Tile border = %d,%d,%d,%d\n", l_tile->x0, l_tile->y0,l_tile->x1,l_tile->y1);*/
         
         /*tile->numcomps = image->numcomps; */
         for (compno = 0; compno < l_tile->numcomps; ++compno) {
@@ skipping 1500 matching lines @@
                                 }
                                 break;
                 }
 
                 ++l_img_comp;
                 ++l_tilec;
         }
 
         return OPJ_TRUE;
 }