openjpeg: Prevent an integer overflow in opj_pi_create_decode.

third_party/libopenjpeg20/pi.c

 /*
  * The copyright in this software is being made available under the 2-clauses 
  * BSD License, included below. This software may be subject to other third 
  * party and contributor rights, including patent rights, and no such rights
  * are granted under this license.
  *
  * Copyright (c) 2002-2014, Universite catholique de Louvain (UCL), Belgium
  * Copyright (c) 2002-2014, Professor Benoit Macq
  * Copyright (c) 2001-2003, David Janssens
  * Copyright (c) 2002-2003, Yannick Verschueren
@@ skipping 1230 matching lines @@
         l_step_c = l_max_prec * l_step_p;
         l_step_r = p_image->numcomps * l_step_c;
         l_step_l = l_max_res * l_step_r;
 
         /* set values for first packet iterator */
         l_current_pi = l_pi;
 
         /* memory allocation for include */
         l_current_pi->include = 00;
         if
-                (l_step_l && l_tcp->numlayers < UINT_MAX / l_step_l - 1)
+                (l_step_l && l_tcp->numlayers < UINT_MAX / sizeof(OPJ_INT16) / l_step_l - 1)
         {
                 l_current_pi->include = (OPJ_INT16*)opj_calloc((l_tcp->numlayers + 1) * l_step_l, sizeof(OPJ_INT16));
         }
 
         if
                 (!l_current_pi->include)
         {
                 opj_free(l_tmp_data);
                 opj_free(l_tmp_ptr);
                 opj_pi_destroy(l_pi, l_bound);
@@ skipping 622 matching lines @@
                 case OPJ_PCRL:
                         return opj_pi_next_pcrl(pi);
                 case OPJ_CPRL:
                         return opj_pi_next_cprl(pi);
                 case OPJ_PROG_UNKNOWN:
                         return OPJ_FALSE;
         }
         
         return OPJ_FALSE;
 }