Update openjpeg

core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/t1.c

 /*
  * The copyright in this software is being made available under the 2-clauses 
  * BSD License, included below. This software may be subject to other third 
  * party and contributor rights, including patent rights, and no such rights
  * are granted under this license.
  *
  * Copyright (c) 2002-2014, Universite catholique de Louvain (UCL), Belgium
  * Copyright (c) 2002-2014, Professor Benoit Macq
  * Copyright (c) 2001-2003, David Janssens
  * Copyright (c) 2002-2003, Yannick Verschueren
@@ skipping 1145 matching lines @@
         wmsedec *= wmsedec * nmsedec / 8192.0;
 
         return wmsedec;
 }
 
 OPJ_BOOL opj_t1_allocate_buffers(
                 opj_t1_t *t1,
                 OPJ_UINT32 w,
                 OPJ_UINT32 h)
 {
         OPJ_UINT32 datasize=w * h;

[Tom Sepez, 2014/09/25 19:52:05]

This looks worrysome.  Does this overflow? What about when multiplied by 4
below?

         OPJ_UINT32 flagssize;
 
         if(datasize > t1->datasize){
                 opj_aligned_free(t1->data);
                 t1->data = (OPJ_INT32*) opj_aligned_malloc(datasize * sizeof(OPJ_INT32));
                 if(!t1->data){
+                        /* FIXME event manager error callback */
                         return OPJ_FALSE;
                 }
                 t1->datasize=datasize;
         }
         memset(t1->data,0,datasize * sizeof(OPJ_INT32));
 
         t1->flags_stride=w+2;
         flagssize=t1->flags_stride * (h+2);
 
         if(flagssize > t1->flagssize){
                 opj_aligned_free(t1->flags);
                 t1->flags = (opj_flag_t*) opj_aligned_malloc(flagssize * sizeof(opj_flag_t));
                 if(!t1->flags){
+                        /* FIXME event manager error callback */
                         return OPJ_FALSE;
                 }
                 t1->flagssize=flagssize;
         }
         memset(t1->flags,0,flagssize * sizeof(opj_flag_t));
 
         t1->w=w;
         t1->h=h;
 
         return OPJ_TRUE;
@@ skipping 552 matching lines @@
                                 opj_mqc_setcurctx(mqc, opj_t1_getctxno_sc(flag));
                                 v = opj_mqc_decode(mqc) ^ opj_t1_getspb(flag);
                                 *datap = v ? -oneplushalf : oneplushalf;
                                 opj_t1_updateflags(flagsp, v, t1->flags_stride);
                         }
                 }
                 *flagsp |= T1_VISIT;
         }
 }                               /* VSC and  BYPASS by Antonin */
 #endif