Update openjpeg to r2908

core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/jp2.c

 /*
  * The copyright in this software is being made available under the 2-clauses 
  * BSD License, included below. This software may be subject to other third 
  * party and contributor rights, including patent rights, and no such rights
  * are granted under this license.
  *
  * Copyright (c) 2002-2014, Universite catholique de Louvain (UCL), Belgium
  * Copyright (c) 2002-2014, Professor Benoit Macq
  * Copyright (c) 2001-2003, David Janssens
  * Copyright (c) 2002-2003, Yannick Verschueren
@@ skipping 746 matching lines @@
 }
 
 static OPJ_BOOL opj_jp2_check_color(opj_image_t *image, opj_jp2_color_t *color, opj_event_mgr_t *p_manager)
 {
         OPJ_UINT16 i;
 
         /* testcase 4149.pdf.SIGSEGV.cf7.3501 */
         if (color->jp2_cdef) {
                 opj_jp2_cdef_info_t *info = color->jp2_cdef->info;
                 OPJ_UINT16 n = color->jp2_cdef->n;
+                OPJ_UINT32 nr_channels = image->numcomps; /* FIXME image->numcomps == jp2->numcomps before color is applied ??? */
+
+                /* cdef applies to cmap channels if any */
+                if (color->jp2_pclr && color->jp2_pclr->cmap) {
+                        nr_channels = (OPJ_UINT32)color->jp2_pclr->nr_channels;
+                }
 
                 for (i = 0; i < n; i++) {
                         if (info[i].cn >= image->numcomps) {
                                 opj_event_msg(p_manager, EVT_ERROR, "Invalid component index %d (>= %d).\n", info[i].cn, image->numcomps);
                                 return OPJ_FALSE;
                         }
                         if (info[i].asoc > 0 && (OPJ_UINT32)(info[i].asoc - 1) >= image->numcomps) {
                                 opj_event_msg(p_manager, EVT_ERROR, "Invalid component index %d (>= %d).\n", info[i].asoc - 1, image->numcomps);
                                 return OPJ_FALSE;
                         }
                 }
+
+                /* issue 397 */
+                /* ISO 15444-1 states that if cdef is present, it shall contain a complete list of channel definitions. */
+                while (nr_channels > 0)
+                {
+                        for(i = 0; i < n; ++i) {
+                                if ((OPJ_UINT32)info[i].cn == (nr_channels - 1U)) {
+                                        break;
+                                }
+                        }
+                        if (i == n) {
+                                opj_event_msg(p_manager, EVT_ERROR, "Incomplete channel definitions.\n");
+                                return OPJ_FALSE;
+                        }
+                        --nr_channels;
+                }
         }
 
         /* testcases 451.pdf.SIGSEGV.f4c.3723, 451.pdf.SIGSEGV.5b5.3723 and
            66ea31acbb0f23a2bbc91f64d69a03f5_signal_sigsegv_13937c0_7030_5725.pdf */
         if (color->jp2_pclr && color->jp2_pclr->cmap) {
                 OPJ_UINT16 nr_channels = color->jp2_pclr->nr_channels;
                 opj_jp2_cmap_comp_t *cmap = color->jp2_pclr->cmap;
                 OPJ_BOOL *pcol_usage, is_sane = OPJ_TRUE;
 
                 /* verify that all original components match an existing one */
@@ skipping 222 matching lines @@
                 channel_size[i] = (OPJ_BYTE)((l_value & 0x7f) + 1);
                 channel_sign[i] = (l_value & 0x80) ? 1 : 0;
         }
 
         for(j = 0; j < nr_entries; ++j) {
                 for(i = 0; i < nr_channels; ++i) {
                         OPJ_UINT32 bytes_to_read = (OPJ_UINT32)((channel_size[i]+7)>>3);
 
                         if (bytes_to_read > sizeof(OPJ_UINT32))
                                 bytes_to_read = sizeof(OPJ_UINT32);
-                        if ((ptrdiff_t)p_pclr_header_size < p_pclr_header_data - orig_header_data + (ptrdiff_t)bytes_to_read)
+                        if ((ptrdiff_t)p_pclr_header_size < (ptrdiff_t)(p_pclr_header_data - orig_header_data) + (ptrdiff_t)bytes_to_read)
                                 return OPJ_FALSE;
 
                         opj_read_bytes(p_pclr_header_data, &l_value , bytes_to_read);   /* Cji */
                         p_pclr_header_data += bytes_to_read;
                         *entries = (OPJ_UINT32) l_value;
                         entries++;
                 }
         }
 
         return OPJ_TRUE;
@@ skipping 242 matching lines @@
                 {
                         opj_read_bytes(p_colr_header_data,&l_value,1);          /* icc values */
                         ++p_colr_header_data;
                         jp2->color.icc_profile_buf[it_icc_value] = (OPJ_BYTE) l_value;
                 }
             
         jp2->color.jp2_has_colr = 1;
         }
         else if (jp2->meth > 2)
     {
-        /*      ISO/IEC 15444-1:2004 (E), Table I.9  Legal METH values:
+        /*      ISO/IEC 15444-1:2004 (E), Table I.9 Legal METH values:
         conforming JP2 reader shall ignore the entire Colour Specification box.*/
         opj_event_msg(p_manager, EVT_INFO, "COLR BOX meth value is not a regular value (%d), " 
             "so we will ignore the entire Colour Specification box. \n", jp2->meth);
     }
     return OPJ_TRUE;
 }
 
 OPJ_BOOL opj_jp2_decode(opj_jp2_t *jp2,
                         opj_stream_private_t *p_stream,
                         opj_image_t* p_image,
@@ skipping 542 matching lines @@
                                 opj_free(l_current_data);
                                 return OPJ_FALSE;
                         }
                 }
                 else if (box.length == 0) {
                         opj_event_msg(p_manager, EVT_ERROR, "Cannot handle box of undefined sizes\n");
                         opj_free(l_current_data);
                         return OPJ_FALSE;
                 }
                 /* testcase 1851.pdf.SIGSEGV.ce9.948 */
-                else if (box.length < l_nb_bytes_read) {
+        else if (box.length < l_nb_bytes_read) {
                         opj_event_msg(p_manager, EVT_ERROR, "invalid box size %d (%x)\n", box.length, box.type);
                         opj_free(l_current_data);
                         return OPJ_FALSE;
                 }
 
                 l_current_handler = opj_jp2_find_handler(box.type);
                 l_current_data_size = box.length - l_nb_bytes_read;
 
                 if (l_current_handler != 00) {
+                        if ((OPJ_OFF_T)l_current_data_size > opj_stream_get_number_byte_left(stream)) {
+                                /* do not even try to malloc if we can't read */
+                                opj_event_msg(p_manager, EVT_ERROR, "Invalid box size %d for box '%c%c%c%c'. Need %d bytes, %d bytes remaining \n", box.length, (OPJ_BYTE)(box.type>>24), (OPJ_BYTE)(box.type>>16), (OPJ_BYTE)(box.type>>8), (OPJ_BYTE)(box.type>>0), l_current_data_size, (OPJ_UINT32)opj_stream_get_number_byte_left(stream));
+                                opj_free(l_current_data);
+                                return OPJ_FALSE;
+                        }
                         if (l_current_data_size > l_last_data_size) {
                                 OPJ_BYTE* new_current_data = (OPJ_BYTE*)opj_realloc(l_current_data,l_current_data_size);
                                 if (!new_current_data) {
                                         opj_free(l_current_data);
                     opj_event_msg(p_manager, EVT_ERROR, "Not enough memory to handle jpeg2000 box\n");
                                         return OPJ_FALSE;
                                 }
                 l_current_data = new_current_data;
                                 l_last_data_size = l_current_data_size;
                         }
@@ skipping 291 matching lines @@
 */
 static OPJ_BOOL opj_jp2_read_jp2h(  opj_jp2_t *jp2,
                                     OPJ_BYTE *p_header_data,
                                     OPJ_UINT32 p_header_size,
                                     opj_event_mgr_t * p_manager
                                     )
 {
         OPJ_UINT32 l_box_size=0, l_current_data_size = 0;
         opj_jp2_box_t box;
         const opj_jp2_header_handler_t * l_current_handler;
+        OPJ_BOOL l_has_ihdr = 0;
 
         /* preconditions */
         assert(p_header_data != 00);
         assert(jp2 != 00);
         assert(p_manager != 00);
 
         /* make sure the box is well placed */
         if ((jp2->jp2_state & JP2_STATE_FILE_TYPE) != JP2_STATE_FILE_TYPE ) {
                 opj_event_msg(p_manager, EVT_ERROR, "The  box must be the first box in the file.\n");
                 return OPJ_FALSE;
@@ skipping 20 matching lines @@
 
                 if (l_current_handler != 00) {
                         if (! l_current_handler->handler(jp2,p_header_data,l_current_data_size,p_manager)) {
                                 return OPJ_FALSE;
                         }
                 }
                 else {
                         jp2->jp2_img_state |= JP2_IMG_STATE_UNKNOWN;
                 }
 
+                if (box.type == JP2_IHDR) {
+                        l_has_ihdr = 1;
+                }
+
                 p_header_data += l_current_data_size;
                 p_header_size -= box.length;
         }
 
+        if (l_has_ihdr == 0) {
+                opj_event_msg(p_manager, EVT_ERROR, "Stream error while reading JP2 Header box: no 'ihdr' box.\n");
+                return OPJ_FALSE;
+        }
+
         jp2->jp2_state |= JP2_STATE_HEADER;
 
         return OPJ_TRUE;
 }
 
 OPJ_BOOL opj_jp2_read_boxhdr_char(   opj_jp2_box_t *box,
                                      OPJ_BYTE * p_data,
                                      OPJ_UINT32 * p_number_bytes_read,
                                      OPJ_UINT32 p_box_max_size,
                                      opj_event_mgr_t * p_manager
@@ skipping 48 matching lines @@
 
                 if (box->length == 0) {
                         opj_event_msg(p_manager, EVT_ERROR, "Cannot handle box of undefined sizes\n");
                         return OPJ_FALSE;
                 }
         }
         else if (box->length == 0) {
                 opj_event_msg(p_manager, EVT_ERROR, "Cannot handle box of undefined sizes\n");
                 return OPJ_FALSE;
         }
-
+        if (box->length < *p_number_bytes_read) {
+                opj_event_msg(p_manager, EVT_ERROR, "Box length is inconsistent.\n");
+                return OPJ_FALSE;
+        }
         return OPJ_TRUE;
 }
 
 OPJ_BOOL opj_jp2_read_header(   opj_stream_private_t *p_stream,
                                 opj_jp2_t *jp2,
                                 opj_image_t ** p_image,
                                 opj_event_mgr_t * p_manager
                                 )
 {
         /* preconditions */
@@ skipping 489 matching lines @@
   len = opj_stream_tell(cio)-lenp;
   opj_stream_skip(cio, lenp, p_manager);
   opj_write_bytes(l_data_header,len,4);/* L              */
   opj_stream_write_data(cio,l_data_header,4,p_manager);
   opj_stream_seek(cio, lenp+len,p_manager);
 
   return len;
 }
 #endif
 #endif /* USE_JPIP */