Upgrade openjpeg to revision 2997.

core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/j2k.c

 /*
  * The copyright in this software is being made available under the 2-clauses 
  * BSD License, included below. This software may be subject to other third 
  * party and contributor rights, including patent rights, and no such rights
  * are granted under this license.
  *
  * Copyright (c) 2002-2014, Universite catholique de Louvain (UCL), Belgium
  * Copyright (c) 2002-2014, Professor Benoit Macq
  * Copyright (c) 2001-2003, David Janssens
  * Copyright (c) 2002-2003, Yannick Verschueren
@@ skipping 1901 matching lines @@
                                  OPJ_BYTE * p_header_data,
                                  OPJ_UINT32 p_header_size,
                                  opj_event_mgr_t * p_manager
                                  )
 {
         OPJ_UINT32 i;
         OPJ_UINT32 l_nb_comp;
         OPJ_UINT32 l_nb_comp_remain;
         OPJ_UINT32 l_remaining_size;
         OPJ_UINT32 l_nb_tiles;
-        OPJ_UINT32 l_tmp;
+        OPJ_UINT32 l_tmp, l_tx1, l_ty1;
         opj_image_t *l_image = 00;
         opj_cp_t *l_cp = 00;
         opj_image_comp_t * l_img_comp = 00;
         opj_tcp_t * l_current_tile_param = 00;
 
         /* preconditions */
         assert(p_j2k != 00);
         assert(p_manager != 00);
         assert(p_header_data != 00);
 
@@ skipping 41 matching lines @@
                 opj_event_msg(p_manager, EVT_ERROR, "Error with SIZ marker: number of component is illegal -> %d\n", l_tmp);
                 return OPJ_FALSE;
         }
 
         if (l_image->numcomps != l_nb_comp) {
                 opj_event_msg(p_manager, EVT_ERROR, "Error with SIZ marker: number of component is not compatible with the remaining number of parameters ( %d vs %d)\n", l_image->numcomps, l_nb_comp);
                 return OPJ_FALSE;
         }
 
         /* testcase 4035.pdf.SIGSEGV.d8b.3375 */
-        if (l_image->x0 > l_image->x1 || l_image->y0 > l_image->y1) {
-                opj_event_msg(p_manager, EVT_ERROR, "Error with SIZ marker: negative image size (%d x %d)\n", l_image->x1 - l_image->x0, l_image->y1 - l_image->y0);
+        /* testcase issue427-null-image-size.jp2 */
+        if ((l_image->x0 >= l_image->x1) || (l_image->y0 >= l_image->y1)) {
+                opj_event_msg(p_manager, EVT_ERROR, "Error with SIZ marker: negative or zero image size (%d x %d)\n", l_image->x1 - l_image->x0, l_image->y1 - l_image->y0);
                 return OPJ_FALSE;
         }
         /* testcase 2539.pdf.SIGFPE.706.1712 (also 3622.pdf.SIGFPE.706.2916 and 4008.pdf.SIGFPE.706.3345 and maybe more) */
         if (!(l_cp->tdx * l_cp->tdy)) {
                 opj_event_msg(p_manager, EVT_ERROR, "Error with SIZ marker: invalid tile size (tdx: %d, tdy: %d)\n", l_cp->tdx, l_cp->tdy);
                 return OPJ_FALSE;
         }
 
         /* testcase 1610.pdf.SIGSEGV.59c.681 */
         if (((OPJ_UINT64)l_image->x1) * ((OPJ_UINT64)l_image->y1) != (l_image->x1 * l_image->y1)) {
                 opj_event_msg(p_manager, EVT_ERROR, "Prevent buffer overflow (x1: %d, y1: %d)\n", l_image->x1, l_image->y1);
                 return OPJ_FALSE;
         }
 
+        /* testcase issue427-illegal-tile-offset.jp2 */
+        l_tx1 = l_cp->tx0 + l_cp->tdx;
+        if (l_tx1 < l_cp->tx0) { /* manage overflow */
+                l_tx1 = 0xFFFFFFFFU;
+        }
+        l_ty1 = l_cp->ty0 + l_cp->tdy;
+        if (l_ty1 < l_cp->ty0) { /* manage overflow */
+                l_ty1 = 0xFFFFFFFFU;
+        }
+        if ((l_cp->tx0 > l_image->x0) || (l_cp->ty0 > l_image->y0) || (l_tx1 <= l_image->x0) || (l_ty1 <= l_image->y0) ) {
+                opj_event_msg(p_manager, EVT_ERROR, "Error with SIZ marker: illegal tile offset\n");
+                return OPJ_FALSE;
+        }
+
 #ifdef USE_JPWL
         if (l_cp->correct) {
                 /* if JPWL is on, we check whether TX errors have damaged
                   too much the SIZ parameters */
                 if (!(l_image->x1 * l_image->y1)) {
                         opj_event_msg(p_manager, EVT_ERROR,
                                 "JPWL: bad image size (%d x %d)\n",
                                 l_image->x1, l_image->y1);
                         if (!JPWL_ASSUME || JPWL_ASSUME) {
                                 opj_event_msg(p_manager, EVT_ERROR, "JPWL: giving up\n");
@@ skipping 3204 matching lines @@
                                 l_tcp->m_nb_mct_records = 0;
                                 opj_event_msg(p_manager, EVT_ERROR, "Not enough memory to read MCT marker\n");
                                 return OPJ_FALSE;
                         }
                         l_tcp->m_mct_records = new_mct_records;
                         l_mct_data = l_tcp->m_mct_records + l_tcp->m_nb_mct_records;
                         memset(l_mct_data ,0,(l_tcp->m_nb_max_mct_records - l_tcp->m_nb_mct_records) * sizeof(opj_mct_data_t));
                 }
 
                 l_mct_data = l_tcp->m_mct_records + l_tcp->m_nb_mct_records;
+                ++l_tcp->m_nb_mct_records;
         }
 
         if (l_mct_data->m_data) {
                 opj_free(l_mct_data->m_data);
                 l_mct_data->m_data = 00;
         }
 
         l_mct_data->m_index = l_indix;
         l_mct_data->m_array_type = (J2K_MCT_ARRAY_TYPE)((l_tmp  >> 8) & 3);
         l_mct_data->m_element_type = (J2K_MCT_ELEMENT_TYPE)((l_tmp  >> 10) & 3);
 
         opj_read_bytes(p_header_data,&l_tmp,2);                         /* Ymct */
         p_header_data+=2;
         if (l_tmp != 0) {
                 opj_event_msg(p_manager, EVT_WARNING, "Cannot take in charge multiple MCT markers\n");
                 return OPJ_TRUE;
         }
 
         p_header_size -= 6;
 
         l_mct_data->m_data = (OPJ_BYTE*)opj_malloc(p_header_size);
         if (! l_mct_data->m_data) {
                 opj_event_msg(p_manager, EVT_ERROR, "Error reading MCT marker\n");
                 return OPJ_FALSE;
         }
         memcpy(l_mct_data->m_data,p_header_data,p_header_size);
 
         l_mct_data->m_data_size = p_header_size;
-        ++l_tcp->m_nb_mct_records;
 
         return OPJ_TRUE;
 }
 
 OPJ_BOOL opj_j2k_write_mcc_record(      opj_j2k_t *p_j2k,
                                                                 struct opj_simple_mcc_decorrelation_data * p_mcc_record,
                                                                 struct opj_stream_private *p_stream,
                                                                 struct opj_event_mgr * p_manager )
 {
         OPJ_UINT32 i;
@@ skipping 1301 matching lines @@
                             tccp->m_dc_level_shift = l_dc_shift[i];
                     }
 
                     if (opj_j2k_setup_mct_encoding(tcp,image) == OPJ_FALSE) {
                         /* free will be handled by opj_j2k_destroy */
                                                                                                 opj_event_msg(p_manager, EVT_ERROR, "Failed to setup j2k mct encoding\n");
                         return OPJ_FALSE;
                     }
                 }
                 else {
-                    if(tcp->mct==1 && image->numcomps == 3) { /* RGB->YCC MCT is enabled */
+                    if(tcp->mct==1 && image->numcomps >= 3) { /* RGB->YCC MCT is enabled */
                         if ((image->comps[0].dx != image->comps[1].dx) ||
                                 (image->comps[0].dx != image->comps[2].dx) ||
                                 (image->comps[0].dy != image->comps[1].dy) ||
                                 (image->comps[0].dy != image->comps[2].dy)) {
                             opj_event_msg(p_manager, EVT_WARNING, "Cannot perform MCT on components with different sizes. Disabling MCT.\n");
                             tcp->mct = 0;
                         }
                     }
                         for (i = 0; i < image->numcomps; i++) {
                                 opj_tccp_t *tccp = &tcp->tccps[i];
@@ skipping 467 matching lines @@
         /* STATE checking */
         /* make sure the state is at 0 */
         l_is_valid &= (p_j2k->m_specific_param.m_decoder.m_state == J2K_STATE_NONE);
 
         /* POINTER validation */
         /* make sure a p_j2k codec is present */
         l_is_valid &= (p_j2k->m_procedure_list != 00);
         /* make sure a validation list is present */
         l_is_valid &= (p_j2k->m_validation_list != 00);
 
-              /* ISO 15444-1:2004 states between 1 & 33 (0 -> 32) */
-              /* 33 (32) would always fail the 2 checks below (if a cast to 64bits was done) */
-              /* 32 (31) would always fail the 2 checks below (if a cast to 64bits was done) */
-        /* FIXME Shall we change OPJ_J2K_MAXRLVLS to 31 ? */
-        if ((p_j2k->m_cp.tcps->tccps->numresolutions <= 0) || (p_j2k->m_cp.tcps->tccps->numresolutions > 31)) {
+        /* ISO 15444-1:2004 states between 1 & 33 (0 -> 32) */
+        /* 33 (32) would always fail the check below (if a cast to 64bits was done) */
+        /* FIXME Shall we change OPJ_J2K_MAXRLVLS to 32 ? */
+        if ((p_j2k->m_cp.tcps->tccps->numresolutions <= 0) || (p_j2k->m_cp.tcps->tccps->numresolutions > 32)) {
                 opj_event_msg(p_manager, EVT_ERROR, "Number of resolutions is too high in comparison to the size of tiles\n");
                 return OPJ_FALSE;
         }
 
-        if ((p_j2k->m_cp.tdx) < (OPJ_UINT32) (1 << p_j2k->m_cp.tcps->tccps->numresolutions)) {
+        if ((p_j2k->m_cp.tdx) < (OPJ_UINT32) (1 << (p_j2k->m_cp.tcps->tccps->numresolutions - 1U))) {
                 opj_event_msg(p_manager, EVT_ERROR, "Number of resolutions is too high in comparison to the size of tiles\n");
                 return OPJ_FALSE;
         }
 
-        if ((p_j2k->m_cp.tdy) < (OPJ_UINT32) (1 << p_j2k->m_cp.tcps->tccps->numresolutions)) {
+        if ((p_j2k->m_cp.tdy) < (OPJ_UINT32) (1 << (p_j2k->m_cp.tcps->tccps->numresolutions - 1U))) {
                 opj_event_msg(p_manager, EVT_ERROR, "Number of resolutions is too high in comparison to the size of tiles\n");
                 return OPJ_FALSE;
         }
 
         /* PARAMETER VALIDATION */
         return l_is_valid;
 }
 
 OPJ_BOOL opj_j2k_decoding_validation (  opj_j2k_t *p_j2k,
                                         opj_stream_private_t *p_stream,
@@ skipping 57 matching lines @@
         }
 
         /* Read 2 bytes as the new marker ID */
         opj_read_bytes(p_j2k->m_specific_param.m_decoder.m_header_data,&l_current_marker,2);
 
         /* Try to read until the SOT is detected */
         while (l_current_marker != J2K_MS_SOT) {
 
                 /* Check if the current marker ID is valid */
                 if (l_current_marker < 0xff00) {
-                        opj_event_msg(p_manager, EVT_ERROR, "We expected read a marker ID (0xff--) instead of %.8x\n", l_current_marker);
+                        opj_event_msg(p_manager, EVT_ERROR, "A marker ID was expected (0xff--) instead of %.8x\n", l_current_marker);
                         return OPJ_FALSE;
                 }
 
                 /* Get the marker handler from the marker ID */
                 l_marker_handler = opj_j2k_get_marker_handler(l_current_marker);
 
                 /* Manage case where marker is unknown */
                 if (l_marker_handler->id == J2K_MS_UNK) {
                         if (! opj_j2k_read_unk(p_j2k, p_stream, &l_current_marker, p_manager)){
                                 opj_event_msg(p_manager, EVT_ERROR, "Unknow marker have been detected and generated error.\n");
@@ skipping 2604 matching lines @@
         OPJ_UINT32 i, j;
         OPJ_UINT32 l_nb_tiles;
         OPJ_UINT32 l_max_tile_size = 0, l_current_tile_size;
         OPJ_BYTE * l_current_data = 00;
         opj_tcd_t* p_tcd = 00;
 
         /* preconditions */
         assert(p_j2k != 00);
         assert(p_stream != 00);
         assert(p_manager != 00);
-
+        
         p_tcd = p_j2k->m_tcd;
 
         l_nb_tiles = p_j2k->m_cp.th * p_j2k->m_cp.tw;
         for (i=0;i<l_nb_tiles;++i) {
                 if (! opj_j2k_pre_write_tile(p_j2k,i,p_stream,p_manager)) {
                         if (l_current_data) {
                                 opj_free(l_current_data);
                         }
                         return OPJ_FALSE;
                 }
@@ skipping 770 matching lines @@
                         return OPJ_FALSE;
                 }
                 if (! opj_j2k_post_write_tile(p_j2k,p_stream,p_manager)) {
                         opj_event_msg(p_manager, EVT_ERROR, "Error while opj_j2k_post_write_tile with tile index = %d\n", p_tile_index);
                         return OPJ_FALSE;
                 }
         }
 
         return OPJ_TRUE;
 }