check pointer overflow in t2.c

core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/t2.c

 /*
  * The copyright in this software is being made available under the 2-clauses 
  * BSD License, included below. This software may be subject to other third 
  * party and contributor rights, including patent rights, and no such rights
  * are granted under this license.
  *
  * Copyright (c) 2002-2014, Universite catholique de Louvain (UCL), Belgium
  * Copyright (c) 2002-2014, Professor Benoit Macq
  * Copyright (c) 2001-2003, David Janssens
  * Copyright (c) 2002-2003, Yannick Verschueren
@@ skipping 1114 matching lines @@
                                 l_seg = &l_cblk->segs[l_cblk->numsegs - 1];
 
                                 if (l_seg->numpasses == l_seg->maxpasses) {
                                         ++l_seg;
                                         ++l_cblk->numsegs;
                                 }
                         }
 
                         do {
                                 /* Check possible overflow (on l_current_data only, assumes input args already checked) then size */
-                                if (((OPJ_SIZE_T)(l_current_data + l_seg->newlen) < (OPJ_SIZE_T)l_current_data) || (l_current_data + l_seg->newlen > p_src_data + p_max_length)) {
+                                if ((((OPJ_SIZE_T)l_current_data + (OPJ_SIZE_T)l_seg->newlen) < (OPJ_SIZE_T)l_current_data) || (l_current_data + l_seg->newlen > p_src_data + p_max_length)) {
                                         fprintf(stderr, "read: segment too long (%d) with max (%d) for codeblock %d (p=%d, b=%d, r=%d, c=%d)\n",
                                                 l_seg->newlen, p_max_length, cblkno, p_pi->precno, bandno, p_pi->resno, p_pi->compno);
                                         return OPJ_FALSE;
                                 }
 
 #ifdef USE_JPWL
                         /* we need here a j2k handle to verify if making a check to
                         the validity of cblocks parameters is selected from user (-W) */
 
                                 /* let's check that we are not exceeding */
@@ skipping 200 matching lines @@
                         seg->maxpasses = 10;
                 } else {
                         seg->maxpasses = (((seg - 1)->maxpasses == 1) || ((seg - 1)->maxpasses == 10)) ? 2 : 1;
                 }
         } else {
                 seg->maxpasses = 109;
         }
 
         return OPJ_TRUE;
 }