1008

wumu

2024-10-09 d93a5a61f94ac4cf795ba4a8970d9eeba037f4c3

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
diff --git a/third_party/libopenjpeg20/pi.c b/third_party/libopenjpeg20/pi.c
index 06f1e41..462e07c 100644
--- a/third_party/libopenjpeg20/pi.c
+++ b/third_party/libopenjpeg20/pi.c
@@ -377,6 +377,9 @@ if (!pi->tp_on){
                     prcj = opj_int_floordivpow2(opj_int_ceildiv(pi->y, (OPJ_INT32)(comp->dy << levelno)), (OPJ_INT32)res->pdy)
                          - opj_int_floordivpow2(try0, (OPJ_INT32)res->pdy);
                     pi->precno = (OPJ_UINT32)(prci + prcj * (OPJ_INT32)res->pw);
+                    if (pi->precno >= res->pw * res->ph) {
+                        return OPJ_FALSE;
+                    }
                     for (pi->layno = pi->poc.layno0; pi->layno < pi->poc.layno1; pi->layno++) {
                         index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno * pi->step_c + pi->precno * pi->step_p;
                         if (!pi->include[index]) {
@@ -458,6 +461,9 @@ static OPJ_BOOL opj_pi_next_pcrl(opj_pi_iterator_t * pi) {
                     prcj = opj_int_floordivpow2(opj_int_ceildiv(pi->y, (OPJ_INT32)(comp->dy << levelno)), (OPJ_INT32)res->pdy)
                          - opj_int_floordivpow2(try0, (OPJ_INT32)res->pdy);
                     pi->precno = (OPJ_UINT32)(prci + prcj * (OPJ_INT32)res->pw);
+                    if (pi->precno >= res->pw * res->ph) {
+                        return OPJ_FALSE;
+                    }
                     for (pi->layno = pi->poc.layno0; pi->layno < pi->poc.layno1; pi->layno++) {
                         index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno * pi->step_c + pi->precno * pi->step_p;
                         if (!pi->include[index]) {
@@ -537,6 +543,9 @@ static OPJ_BOOL opj_pi_next_cprl(opj_pi_iterator_t * pi) {
                     prcj = opj_int_floordivpow2(opj_int_ceildiv(pi->y, (OPJ_INT32)(comp->dy << levelno)), (OPJ_INT32)res->pdy)
                          - opj_int_floordivpow2(try0, (OPJ_INT32)res->pdy);
                     pi->precno = (OPJ_UINT32)(prci + prcj * (OPJ_INT32)res->pw);
+                    if (pi->precno >= res->pw * res->ph) {
+                        return OPJ_FALSE;
+                    }
                     for (pi->layno = pi->poc.layno0; pi->layno < pi->poc.layno1; pi->layno++) {
                         index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno * pi->step_c + pi->precno * pi->step_p;
                         if (!pi->include[index]) {