Update openjpeg to r2908

core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/t2.c

 /*
  * The copyright in this software is being made available under the 2-clauses 
  * BSD License, included below. This software may be subject to other third 
  * party and contributor rights, including patent rights, and no such rights
  * are granted under this license.
  *
  * Copyright (c) 2002-2014, Universite catholique de Louvain (UCL), Belgium
  * Copyright (c) 2002-2014, Professor Benoit Macq
  * Copyright (c) 2001-2003, David Janssens
  * Copyright (c) 2002-2003, Yannick Verschueren
@@ skipping 224 matching lines @@
                 for     (compno = 0; compno < l_max_comp; ++compno) {
                         OPJ_UINT32 l_comp_len = 0;
                         l_current_pi = l_pi;
 
                         for (poc = 0; poc < pocno ; ++poc) {
                                 OPJ_UINT32 l_tp_num = compno;
 
                                 /* TODO MSD : check why this function cannot fail (cf. v1) */
                                 opj_pi_create_encode(l_pi, l_cp,p_tile_no,poc,l_tp_num,p_tp_pos,p_t2_mode);
 
+                                if (l_current_pi->poc.prg == OPJ_PROG_UNKNOWN) {
+                                    /* TODO ADE : add an error */
+                                    opj_pi_destroy(l_pi, l_nb_pocs);
+                                    return OPJ_FALSE;
+                                }
                                 while (opj_pi_next(l_current_pi)) {
                                         if (l_current_pi->layno < p_maxlayers) {
                                                 l_nb_bytes = 0;
 
                                                 if (! opj_t2_encode_packet(p_tile_no,p_tile, l_tcp, l_current_pi, l_current_data, &l_nb_bytes, p_max_len, cstr_info)) {
                                                         opj_pi_destroy(l_pi, l_nb_pocs);
                                                         return OPJ_FALSE;
                                                 }
 
                                                 l_comp_len += l_nb_bytes;
@@ skipping 12 matching lines @@
                                 }
 
                                 ++l_current_pi;
                         }
                 }
         }
         else {  /* t2_mode == FINAL_PASS  */
                 opj_pi_create_encode(l_pi, l_cp,p_tile_no,p_pino,p_tp_num,p_tp_pos,p_t2_mode);
 
                 l_current_pi = &l_pi[p_pino];
-
+                if (l_current_pi->poc.prg == OPJ_PROG_UNKNOWN) {
+                    /* TODO ADE : add an error */
+                    opj_pi_destroy(l_pi, l_nb_pocs);
+                    return OPJ_FALSE;
+                }
                 while (opj_pi_next(l_current_pi)) {
                         if (l_current_pi->layno < p_maxlayers) {
                                 l_nb_bytes=0;
 
                                 if (! opj_t2_encode_packet(p_tile_no,p_tile, l_tcp, l_current_pi, l_current_data, &l_nb_bytes, p_max_len, cstr_info)) {
                                         opj_pi_destroy(l_pi, l_nb_pocs);
                                         return OPJ_FALSE;
                                 }
 
                                 l_current_data += l_nb_bytes;
@@ skipping 91 matching lines @@
                  * and no l_img_comp->resno_decoded are computed
                  */
                 OPJ_BOOL* first_pass_failed = (OPJ_BOOL*)opj_malloc(l_image->numcomps * sizeof(OPJ_BOOL));
                 if (!first_pass_failed)
                 {
                     opj_pi_destroy(l_pi,l_nb_pocs);
                     return OPJ_FALSE;
                 }
                 memset(first_pass_failed, OPJ_TRUE, l_image->numcomps * sizeof(OPJ_BOOL));
 
+                if (l_current_pi->poc.prg == OPJ_PROG_UNKNOWN) {
+                    /* TODO ADE : add an error */
+                    opj_pi_destroy(l_pi, l_nb_pocs);
+                    return OPJ_FALSE;
+                }
                 while (opj_pi_next(l_current_pi)) {
                   JAS_FPRINTF( stderr, "packet offset=00000166 prg=%d cmptno=%02d rlvlno=%02d prcno=%03d lyrno=%02d\n\n",
                     l_current_pi->poc.prg1, l_current_pi->compno, l_current_pi->resno, l_current_pi->precno, l_current_pi->layno );
 
                         if (l_tcp->num_layers_to_decode > l_current_pi->layno
                                         && l_current_pi->resno < p_tile->comps[l_current_pi->compno].minimum_num_resolutions) {
                                 l_nb_bytes_read = 0;
 
                                 first_pass_failed[l_current_pi->compno] = OPJ_FALSE;
 
@@ skipping 859 matching lines @@
                         else {
                                 l_seg = &l_cblk->segs[l_cblk->numsegs - 1];
 
                                 if (l_seg->numpasses == l_seg->maxpasses) {
                                         ++l_seg;
                                         ++l_cblk->numsegs;
                                 }
                         }
 
                         do {
-                                if (* p_data_read + l_seg->newlen > p_max_length) {
+                                /* Check possible overflow then size */
+                                if (((*p_data_read + l_seg->newlen) < (*p_data_read)) || ((*p_data_read + l_seg->newlen) > p_max_length)) {
                                         fprintf(stderr, "skip: segment too long (%d) with max (%d) for codeblock %d (p=%d, b=%d, r=%d, c=%d)\n",
                                                 l_seg->newlen, p_max_length, cblkno, p_pi->precno, bandno, p_pi->resno, p_pi->compno);
                                         return OPJ_FALSE;
                                 }
 
 #ifdef USE_JPWL
                         /* we need here a j2k handle to verify if making a check to
                         the validity of cblocks parameters is selected from user (-W) */
 
                                 /* let's check that we are not exceeding */
@@ skipping 67 matching lines @@
                         seg->maxpasses = 10;
                 } else {
                         seg->maxpasses = (((seg - 1)->maxpasses == 1) || ((seg - 1)->maxpasses == 10)) ? 2 : 1;
                 }
         } else {
                 seg->maxpasses = 109;
         }
 
         return OPJ_TRUE;
 }