1diff --git a/third_party/libopenjpeg20/README.pdfium b/third_party/libopenjpeg20/README.pdfium 2index b1012af..a40ed7b 100644 3--- a/third_party/libopenjpeg20/README.pdfium 4+++ b/third_party/libopenjpeg20/README.pdfium 5@@ -29,4 +29,5 @@ Local Modifications: 6 0017-tcd_init_tile.patch: Prevent integer overflows during calculation of |l_nb_precinct_size|. 7 0018-tcd_get_decoded_tile_size.patch: Fix an integer overflow in opj_tcd_get_decoded_tile_size. 8 0019-tcd_init_tile.patch: Prevent integer overflows during calculation of |l_nb_code_blocks_size|. 9+0020-opj_aligned_malloc.patch: Prevent overflows when using opj_aligned_malloc(). 10 TODO(thestig): List all the other patches. 11diff --git a/third_party/libopenjpeg20/dwt.c b/third_party/libopenjpeg20/dwt.c 12index 3b92bdf..a666d1c 100644 13--- a/third_party/libopenjpeg20/dwt.c 14+++ b/third_party/libopenjpeg20/dwt.c 15@@ -576,6 +576,9 @@ static OPJ_BOOL opj_dwt_decode_tile(const opj_tcd_tilecomp_t* tilec, OPJ_UINT32 16 OPJ_UINT32 w = (OPJ_UINT32)(tilec->x1 - tilec->x0); 17 18 h.mem_count = opj_dwt_max_resolution(tr, numres); 19+ if (((OPJ_UINT32)-1) / (OPJ_UINT32)sizeof(OPJ_INT32) < (OPJ_UINT32)h.mem_count) { 20+ return OPJ_FALSE; 21+ } 22 h.mem = (OPJ_INT32*)opj_aligned_malloc(h.mem_count * sizeof(OPJ_INT32)); 23 if (! h.mem){ 24 /* FIXME event manager error callback */ 25@@ -850,7 +853,17 @@ OPJ_BOOL opj_dwt_decode_real(opj_tcd_tilecomp_t* restrict tilec, OPJ_UINT32 numr 26 27 OPJ_UINT32 w = (OPJ_UINT32)(tilec->x1 - tilec->x0); 28 29- h.wavelet = (opj_v4_t*) opj_aligned_malloc((opj_dwt_max_resolution(res, numres)+5) * sizeof(opj_v4_t)); 30+ OPJ_UINT32 mr = opj_dwt_max_resolution(res, numres); 31+ 32+ if (mr >= ((OPJ_UINT32)-5)) { 33+ return OPJ_FALSE; 34+ } 35+ mr += 5; 36+ 37+ if (((OPJ_UINT32)-1) / (OPJ_UINT32)sizeof(opj_v4_t) < mr) { 38+ return OPJ_FALSE; 39+ } 40+ h.wavelet = (opj_v4_t*) opj_aligned_malloc(mr * sizeof(opj_v4_t)); 41 if (!h.wavelet) { 42 /* FIXME event manager error callback */ 43 return OPJ_FALSE; 44diff --git a/third_party/libopenjpeg20/t1.c b/third_party/libopenjpeg20/t1.c 45index 108ce78..a119db1 100644 46--- a/third_party/libopenjpeg20/t1.c 47+++ b/third_party/libopenjpeg20/t1.c 48@@ -1173,6 +1173,9 @@ static OPJ_BOOL opj_t1_allocate_buffers( 49 if (!t1->encoder) { 50 if(datasize > t1->datasize){ 51 opj_aligned_free(t1->data); 52+ if (((OPJ_UINT32)-1) / (OPJ_UINT32)sizeof(OPJ_INT32) < datasize) { 53+ return OPJ_FALSE; 54+ } 55 t1->data = (OPJ_INT32*) opj_aligned_malloc(datasize * sizeof(OPJ_INT32)); 56 if(!t1->data){ 57 /* FIXME event manager error callback */ 58@@ -1187,6 +1190,9 @@ static OPJ_BOOL opj_t1_allocate_buffers( 59 60 if(flagssize > t1->flagssize){ 61 opj_aligned_free(t1->flags); 62+ if (((OPJ_UINT32)-1) / (OPJ_UINT32)sizeof(opj_flag_t) < flagssize) { 63+ return OPJ_FALSE; 64+ } 65 t1->flags = (opj_flag_t*) opj_aligned_malloc(flagssize * sizeof(opj_flag_t)); 66 if(!t1->flags){ 67 /* FIXME event manager error callback */ 68