Update openjpeg

core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/t2.c

 /*
  * The copyright in this software is being made available under the 2-clauses 
  * BSD License, included below. This software may be subject to other third 
  * party and contributor rights, including patent rights, and no such rights
  * are granted under this license.
  *
  * Copyright (c) 2002-2014, Universite catholique de Louvain (UCL), Belgium
  * Copyright (c) 2002-2014, Professor Benoit Macq
  * Copyright (c) 2001-2003, David Janssens
  * Copyright (c) 2002-2003, Yannick Verschueren
@@ skipping 581 matching lines @@
                                 cblk = &prc->cblks.enc[cblkno];
 
                                 cblk->numpasses = 0;
                                 opj_tgt_setvalue(prc->imsbtree, cblkno, band->numbps - (OPJ_INT32)cblk->numbps);
                         }
                         ++band;
                 }
         }
 
         bio = opj_bio_create();
+        if (!bio) {
+                /* FIXME event manager error callback */
+                return OPJ_FALSE;
+        }
         opj_bio_init_enc(bio, c, length);
         opj_bio_write(bio, 1, 1);           /* Empty header bit */
 
         /* Writing Packet header */
         band = res->bands;
         for (bandno = 0; bandno < res->numbands; ++bandno)      {
                 opj_tcd_precinct_t *prc = &band->precincts[precno];
 
                 l_nb_blocks = prc->cw * prc->ch;
                 cblk = prc->cblks.enc;
@@ skipping 510 matching lines @@
                         else {
                                 l_seg = &l_cblk->segs[l_cblk->numsegs - 1];
 
                                 if (l_seg->numpasses == l_seg->maxpasses) {
                                         ++l_seg;
                                         ++l_cblk->numsegs;
                                 }
                         }
 
                         do {
-                                if (l_current_data + l_seg->newlen > p_src_data + p_max_length) {
+                                /* Check possible overflow (on l_current_data only, assumes input args already checked) then size */
+                                if (((OPJ_SIZE_T)(l_current_data + l_seg->newlen) < (OPJ_SIZE_T)l_current_data) || (l_current_data + l_seg->newlen > p_src_data + p_max_length)) {

[Tom Sepez, 2014/09/24 22:33:55]

This check doesn't quite do what we want, and may be removed by an aggressive
optimizer.  We're doing pointer artithmetic (where overflow is undefined) and
then casting to unsigned rather than casting to unsigned (where overflow is
defined) and then doing unsigned arithmetic. [You also would be better off using
uintptr_t or your equivalent instead of size_t, for the sake of strict
correctness.]

you mean:
if (((OPJ_SIZE_T)l_current_data) + ((OPJ_SIZE_T)l_seg->newline)) < ...

                                         fprintf(stderr, "read: segment too long (%d) with max (%d) for codeblock %d (p=%d, b=%d, r=%d, c=%d)\n",
                                                 l_seg->newlen, p_max_length, cblkno, p_pi->precno, bandno, p_pi->resno, p_pi->compno);
                                         return OPJ_FALSE;
                                 }
 
 #ifdef USE_JPWL
                         /* we need here a j2k handle to verify if making a check to
                         the validity of cblocks parameters is selected from user (-W) */
 
                                 /* let's check that we are not exceeding */
@@ skipping 192 matching lines @@
                         seg->maxpasses = 10;
                 } else {
                         seg->maxpasses = (((seg - 1)->maxpasses == 1) || ((seg - 1)->maxpasses == 10)) ? 2 : 1;
                 }
         } else {
                 seg->maxpasses = 109;
         }
 
         return OPJ_TRUE;
 }