Update openjpeg

core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/t2.c

 /*
  * The copyright in this software is being made available under the 2-clauses 
  * BSD License, included below. This software may be subject to other third 
  * party and contributor rights, including patent rights, and no such rights
  * are granted under this license.
  *
  * Copyright (c) 2002-2014, Universite catholique de Louvain (UCL), Belgium
  * Copyright (c) 2002-2014, Professor Benoit Macq
  * Copyright (c) 2001-2003, David Janssens
  * Copyright (c) 2002-2003, Yannick Verschueren
@@ skipping 200 matching lines @@
 {
         OPJ_BYTE *l_current_data = p_dest;
         OPJ_UINT32 l_nb_bytes = 0;
         OPJ_UINT32 compno;
         OPJ_UINT32 poc;
         opj_pi_iterator_t *l_pi = 00;
         opj_pi_iterator_t *l_current_pi = 00;
         opj_image_t *l_image = p_t2->image;
         opj_cp_t *l_cp = p_t2->cp;
         opj_tcp_t *l_tcp = &l_cp->tcps[p_tile_no];
-        OPJ_UINT32 pocno = l_cp->m_specific_param.m_enc.m_cinema == OPJ_CINEMA4K_24? 2: 1;
+        OPJ_UINT32 pocno = (l_cp->rsiz == OPJ_PROFILE_CINEMA_4K)? 2: 1;
         OPJ_UINT32 l_max_comp = l_cp->m_specific_param.m_enc.m_max_comp_size > 0 ? l_image->numcomps : 1;
         OPJ_UINT32 l_nb_pocs = l_tcp->numpocs + 1;
 
         l_pi = opj_pi_initialise_encode(l_image, l_cp, p_tile_no, p_t2_mode);
         if (!l_pi) {
                 return OPJ_FALSE;
         }
 
         * p_data_written = 0;
 
@@ skipping 238 matching lines @@
 /**
  * Creates a Tier 2 handle
  *
  * @param       p_image         Source or destination image
  * @param       p_cp            Image coding parameters.
  * @return              a new T2 handle if successful, NULL otherwise.
 */
 opj_t2_t* opj_t2_create(opj_image_t *p_image, opj_cp_t *p_cp)
 {
         /* create the t2 structure */
-        opj_t2_t *l_t2 = (opj_t2_t*)opj_malloc(sizeof(opj_t2_t));
+        opj_t2_t *l_t2 = (opj_t2_t*)opj_calloc(1,sizeof(opj_t2_t));
         if (!l_t2) {
                 return NULL;
         }
-        memset(l_t2,0,sizeof(opj_t2_t));
 
         l_t2->image = p_image;
         l_t2->cp = p_cp;
 
         return l_t2;
 }
 
 void opj_t2_destroy(opj_t2_t *t2) {
         if(t2) {
                 opj_free(t2);
@@ skipping 97 matching lines @@
                                 cblk = &prc->cblks.enc[cblkno];
 
                                 cblk->numpasses = 0;
                                 opj_tgt_setvalue(prc->imsbtree, cblkno, band->numbps - (OPJ_INT32)cblk->numbps);
                         }
                         ++band;
                 }
         }
 
         bio = opj_bio_create();
+        if (!bio) {
+                /* FIXME event manager error callback */
+                return OPJ_FALSE;
+        }
         opj_bio_init_enc(bio, c, length);
         opj_bio_write(bio, 1, 1);           /* Empty header bit */
 
         /* Writing Packet header */
         band = res->bands;
         for (bandno = 0; bandno < res->numbands; ++bandno)      {
                 opj_tcd_precinct_t *prc = &band->precincts[precno];
 
                 l_nb_blocks = prc->cw * prc->ch;
                 cblk = prc->cblks.enc;
@@ skipping 244 matching lines @@
 
                         ++l_band;
                 }
         }
 
         /* SOP markers */
 
         if (p_tcp->csty & J2K_CP_CSTY_SOP) {
                 if (p_max_length < 6) {
                         /* TODO opj_event_msg(p_t2->cinfo->event_mgr, EVT_WARNING, "Not enough space for expected SOP marker\n"); */
-                        printf("Not enough space for expected SOP marker\n");
+                        fprintf(stderr, "Not enough space for expected SOP marker\n");
                 } else if ((*l_current_data) != 0xff || (*(l_current_data + 1) != 0x91)) {
                         /* TODO opj_event_msg(p_t2->cinfo->event_mgr, EVT_WARNING, "Expected SOP marker\n"); */
-                        printf("Expected SOP marker\n");
-                        fprintf(stderr, "Error : expected SOP marker\n");
+                        fprintf(stderr, "Warning: expected SOP marker\n");
                 } else {
                         l_current_data += 6;
                 }
 
                 /** TODO : check the Nsop value */
         }
 
         /*
         When the marker PPT/PPM is used the packet header are store in PPT/PPM marker
         This part deal with this caracteristic
@@ skipping 29 matching lines @@
         l_present = opj_bio_read(l_bio, 1);
         JAS_FPRINTF(stderr, "present=%d \n", l_present );
         if (!l_present) {
             /* TODO MSD: no test to control the output of this function*/
                 opj_bio_inalign(l_bio);
                 l_header_data += opj_bio_numbytes(l_bio);
                 opj_bio_destroy(l_bio);
 
                 /* EPH markers */
                 if (p_tcp->csty & J2K_CP_CSTY_EPH) {
-                        if (p_max_length < 2) {
+                        if ((*l_modified_length_ptr - (OPJ_UINT32)(l_header_data - *l_header_data_start)) < 2U) {
                                 fprintf(stderr, "Not enough space for expected EPH marker\n");
                         } else if ((*l_header_data) != 0xff || (*(l_header_data + 1) != 0x92)) {
                                 fprintf(stderr, "Error : expected EPH marker\n");
                         } else {
                                 l_header_data += 2;
                         }
                 }
 
                 l_header_length = (OPJ_UINT32)(l_header_data - *l_header_data_start);
                 *l_modified_length_ptr -= l_header_length;
@@ skipping 107 matching lines @@
         if (!opj_bio_inalign(l_bio)) {
                 opj_bio_destroy(l_bio);
                 return OPJ_FALSE;
         }
 
         l_header_data += opj_bio_numbytes(l_bio);
         opj_bio_destroy(l_bio);
 
         /* EPH markers */
         if (p_tcp->csty & J2K_CP_CSTY_EPH) {
-                if (p_max_length < 2) {
+                if ((*l_modified_length_ptr - (OPJ_UINT32)(l_header_data - *l_header_data_start)) < 2U) {
                         fprintf(stderr, "Not enough space for expected EPH marker\n");
                 } else if ((*l_header_data) != 0xff || (*(l_header_data + 1) != 0x92)) {
                         /* TODO opj_event_msg(t2->cinfo->event_mgr, EVT_ERROR, "Expected EPH marker\n"); */
                         fprintf(stderr, "Error : expected EPH marker\n");
                 } else {
                         l_header_data += 2;
                 }
         }
 
         l_header_length = (OPJ_UINT32)(l_header_data - *l_header_data_start);
@@ skipping 63 matching lines @@
                         else {
                                 l_seg = &l_cblk->segs[l_cblk->numsegs - 1];
 
                                 if (l_seg->numpasses == l_seg->maxpasses) {
                                         ++l_seg;
                                         ++l_cblk->numsegs;
                                 }
                         }
 
                         do {
-                                if (l_current_data + l_seg->newlen > p_src_data + p_max_length) {
+                                /* Check possible overflow (on l_current_data only, assumes input args already checked) then size */
+                                if (((OPJ_SIZE_T)(l_current_data + l_seg->newlen) < (OPJ_SIZE_T)l_current_data) || (l_current_data + l_seg->newlen > p_src_data + p_max_length)) {
                                         fprintf(stderr, "read: segment too long (%d) with max (%d) for codeblock %d (p=%d, b=%d, r=%d, c=%d)\n",
                                                 l_seg->newlen, p_max_length, cblkno, p_pi->precno, bandno, p_pi->resno, p_pi->compno);
                                         return OPJ_FALSE;
                                 }
 
 #ifdef USE_JPWL
                         /* we need here a j2k handle to verify if making a check to
                         the validity of cblocks parameters is selected from user (-W) */
 
                                 /* let's check that we are not exceeding */
                                 if ((l_cblk->len + l_seg->newlen) > 8192) {
                                         opj_event_msg(p_t2->cinfo, EVT_WARNING,
                                                 "JPWL: segment too long (%d) for codeblock %d (p=%d, b=%d, r=%d, c=%d)\n",
                                                 l_seg->newlen, cblkno, p_pi->precno, bandno, p_pi->resno, p_pi->compno);
                                         if (!JPWL_ASSUME) {
                                                 opj_event_msg(p_t2->cinfo, EVT_ERROR, "JPWL: giving up\n");
                                                 return OPJ_FALSE;
                                         }
                                         l_seg->newlen = 8192 - l_cblk->len;
                                         opj_event_msg(p_t2->cinfo, EVT_WARNING, "      - truncating segment to %d\n", l_seg->newlen);
                                         break;
                                 };
 
 #endif /* USE_JPWL */
+                                /* Check possible overflow on size */
+                                if ((l_cblk->data_current_size + l_seg->newlen) < l_cblk->data_current_size) {
+                                        fprintf(stderr, "read: segment too long (%d) with current size (%d > %d) for codeblock %d (p=%d, b=%d, r=%d, c=%d)\n",
+                                                l_seg->newlen, l_cblk->data_current_size, 0xFFFFFFFF - l_seg->newlen, cblkno, p_pi->precno, bandno, p_pi->resno, p_pi->compno);
+                                        return OPJ_FALSE;
+                                }
                                 /* Check if the cblk->data have allocated enough memory */
                                 if ((l_cblk->data_current_size + l_seg->newlen) > l_cblk->data_max_size) {
                                     OPJ_BYTE* new_cblk_data = (OPJ_BYTE*) opj_realloc(l_cblk->data, l_cblk->data_current_size + l_seg->newlen);
                                     if(! new_cblk_data) {
                                         opj_free(l_cblk->data);
+                                        l_cblk->data = NULL;
                                         l_cblk->data_max_size = 0;
                                         /* opj_event_msg(p_manager, EVT_ERROR, "Not enough memory to realloc code block cata!\n"); */
                                         return OPJ_FALSE;
                                     }
                                     l_cblk->data_max_size = l_cblk->data_current_size + l_seg->newlen;
                                     l_cblk->data = new_cblk_data;
                                 }
                                
                                 memcpy(l_cblk->data + l_cblk->data_current_size, l_current_data, l_seg->newlen);
 
@@ skipping 18 matching lines @@
 
                         l_cblk->real_num_segs = l_cblk->numsegs;
                         ++l_cblk;
                 } /* next code_block */
 
                 ++l_band;
         }
 
         *(p_data_read) = (OPJ_UINT32)(l_current_data - p_src_data);
 
+
         return OPJ_TRUE;
 }
 
 OPJ_BOOL opj_t2_skip_packet_data(   opj_t2_t* p_t2,
                                     opj_tcd_tile_t *p_tile,
                                     opj_pi_iterator_t *p_pi,
                                     OPJ_UINT32 * p_data_read,
                                     OPJ_UINT32 p_max_length,
                                     opj_packet_info_t *pack_info)
 {
@@ skipping 125 matching lines @@
                         seg->maxpasses = 10;
                 } else {
                         seg->maxpasses = (((seg - 1)->maxpasses == 1) || ((seg - 1)->maxpasses == 10)) ? 2 : 1;
                 }
         } else {
                 seg->maxpasses = 109;
         }
 
         return OPJ_TRUE;
 }