xref: /aosp_15_r20/external/pdfium/third_party/libopenjpeg/0009-opj_pi_next.patch (revision 3ac0a46f773bac49fa9476ec2b1cf3f8da5ec3a4) 
1diff --git a/third_party/libopenjpeg/pi.c b/third_party/libopenjpeg/pi.c
2index 4f7dd50f1..1430d12a9 100644
3--- a/third_party/libopenjpeg/pi.c
4+++ b/third_party/libopenjpeg/pi.c
5@@ -464,6 +464,9 @@ static OPJ_BOOL opj_pi_next_rpcl(opj_pi_iterator_t * pi)
6                                                  (comp->dy << levelno)), res->pdy)
7                            - opj_uint_floordivpow2(try0, res->pdy);
8                     pi->precno = prci + prcj * res->pw;
9+                    if (pi->precno >= res->pw * res->ph) {
10+                      return OPJ_FALSE;
11+                    }
12                     for (pi->layno = pi->poc.layno0; pi->layno < pi->poc.layno1; pi->layno++) {
13                         index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno *
14                                 pi->step_c + pi->precno * pi->step_p;
15@@ -602,6 +605,9 @@ static OPJ_BOOL opj_pi_next_pcrl(opj_pi_iterator_t * pi)
16                                                  (comp->dy << levelno)), res->pdy)
17                            - opj_uint_floordivpow2(try0, res->pdy);
18                     pi->precno = prci + prcj * res->pw;
19+                    if (pi->precno >= res->pw * res->ph) {
20+                      return OPJ_FALSE;
21+                    }
22                     for (pi->layno = pi->poc.layno0; pi->layno < pi->poc.layno1; pi->layno++) {
23                         index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno *
24                                 pi->step_c + pi->precno * pi->step_p;
25@@ -737,6 +743,9 @@ static OPJ_BOOL opj_pi_next_cprl(opj_pi_iterator_t * pi)
26                                                  (comp->dy << levelno)), res->pdy)
27                            - opj_uint_floordivpow2(try0, res->pdy);
28                     pi->precno = (OPJ_UINT32)(prci + prcj * res->pw);
29+                    if (pi->precno >= res->pw * res->ph) {
30+                      return OPJ_FALSE;
31+                    }
32                     for (pi->layno = pi->poc.layno0; pi->layno < pi->poc.layno1; pi->layno++) {
33                         index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno *
34                                 pi->step_c + pi->precno * pi->step_p;
35