update openjpeg to r2911

update openjpeg to r2911

BUG=418976, 425150, 414525
R=tsepez@chromium.org

Committed: https://pdfium.googlesource.com/pdfium/+/4dc95e74e1acc75f4eab08bc771874cd2a9c3a9b

[Bo Xu, 2014-10-22 17:12:51]

bo_xu@foxitsoftware.com changed reviewers:
+ jun_fang@foxitsoftware.com, tsepez@chromium.org

[Bo Xu, 2014-10-22 17:12:51]

Hi Tom, here is another update.

[Tom Sepez, 2014-10-22 19:03:06]

https://codereview.chromium.org/671943002/diff/1/core/src/fxcodec/fx_libopenj...
File core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/tcd.c (right):

https://codereview.chromium.org/671943002/diff/1/core/src/fxcodec/fx_libopenj...
core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/tcd.c:1063: memset(p_code_block,
0, sizeof(opj_tcd_cblk_dec_t));
How do we know that p_code_block can accomodate sizeof(...) bytes?  Is there an
early check against, say, p_code_block->data_max_size?

[Tom Sepez, 2014-10-22 21:55:59]

LGTM based on reply from openjpeg:

Allocation of code blocks is done from line 900. When
opj_tcd_code_block_dec_allocate is called (line 973), it can be easily reviewed
that p_code_block points to a memory block of at least
sizeof(opj_tcd_cblk_dec_t).
p_code_block->data_max_size relates to the size of allocated memory for
p_code_block->data & not p_code_block.
All is ok here.

[Bo Xu, 2014-10-22 22:29:03]

https://codereview.chromium.org/671943002/diff/1/core/src/fxcodec/fx_libopenj...
File core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/tcd.c (right):

https://codereview.chromium.org/671943002/diff/1/core/src/fxcodec/fx_libopenj...
core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/tcd.c:1063: memset(p_code_block,
0, sizeof(opj_tcd_cblk_dec_t));
On 2014/10/22 19:03:06, Tom Sepez wrote:
> How do we know that p_code_block can accomodate sizeof(...) bytes?  Is there
an
> early check against, say, p_code_block->data_max_size?

I am asking openjpeg team to cc you in their bug tracker, so we can raise these
questions and upstream to them.

[Bo Xu, 2014-10-22 22:30:26]

On 2014/10/22 21:55:59, Tom Sepez wrote:
> LGTM based on reply from openjpeg:
> 
> Allocation of code blocks is done from line 900. When
> opj_tcd_code_block_dec_allocate is called (line 973), it can be easily
reviewed
> that p_code_block points to a memory block of at least
> sizeof(opj_tcd_cblk_dec_t).
> p_code_block->data_max_size relates to the size of allocated memory for
> p_code_block->data & not p_code_block.
> All is ok here.

I forgot to publish my previous comments. I also asked them to add you to future
bugs so you can track the fix there as well.

[Bo Xu, 2014-10-22 22:33:14]

Committed patchset #1 (id:1) manually as
4dc95e74e1acc75f4eab08bc771874cd2a9c3a9b (presubmit successful).