1diff --git a/third_party/libopenjpeg20/pi.c b/third_party/libopenjpeg20/pi.c 2index 06f1e41..462e07c 100644 3--- a/third_party/libopenjpeg20/pi.c 4+++ b/third_party/libopenjpeg20/pi.c 5@@ -377,6 +377,9 @@ if (!pi->tp_on){ 6 prcj = opj_int_floordivpow2(opj_int_ceildiv(pi->y, (OPJ_INT32)(comp->dy << levelno)), (OPJ_INT32)res->pdy) 7 - opj_int_floordivpow2(try0, (OPJ_INT32)res->pdy); 8 pi->precno = (OPJ_UINT32)(prci + prcj * (OPJ_INT32)res->pw); 9+ if (pi->precno >= res->pw * res->ph) { 10+ return OPJ_FALSE; 11+ } 12 for (pi->layno = pi->poc.layno0; pi->layno < pi->poc.layno1; pi->layno++) { 13 index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno * pi->step_c + pi->precno * pi->step_p; 14 if (!pi->include[index]) { 15@@ -458,6 +461,9 @@ static OPJ_BOOL opj_pi_next_pcrl(opj_pi_iterator_t * pi) { 16 prcj = opj_int_floordivpow2(opj_int_ceildiv(pi->y, (OPJ_INT32)(comp->dy << levelno)), (OPJ_INT32)res->pdy) 17 - opj_int_floordivpow2(try0, (OPJ_INT32)res->pdy); 18 pi->precno = (OPJ_UINT32)(prci + prcj * (OPJ_INT32)res->pw); 19+ if (pi->precno >= res->pw * res->ph) { 20+ return OPJ_FALSE; 21+ } 22 for (pi->layno = pi->poc.layno0; pi->layno < pi->poc.layno1; pi->layno++) { 23 index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno * pi->step_c + pi->precno * pi->step_p; 24 if (!pi->include[index]) { 25@@ -537,6 +543,9 @@ static OPJ_BOOL opj_pi_next_cprl(opj_pi_iterator_t * pi) { 26 prcj = opj_int_floordivpow2(opj_int_ceildiv(pi->y, (OPJ_INT32)(comp->dy << levelno)), (OPJ_INT32)res->pdy) 27 - opj_int_floordivpow2(try0, (OPJ_INT32)res->pdy); 28 pi->precno = (OPJ_UINT32)(prci + prcj * (OPJ_INT32)res->pw); 29+ if (pi->precno >= res->pw * res->ph) { 30+ return OPJ_FALSE; 31+ } 32 for (pi->layno = pi->poc.layno0; pi->layno < pi->poc.layno1; pi->layno++) { 33 index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno * pi->step_c + pi->precno * pi->step_p; 34 if (!pi->include[index]) { 35