• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1diff --git a/third_party/libopenjpeg20/tcd.c b/third_party/libopenjpeg20/tcd.c
2index 9270efe..06eee4e 100644
3--- a/third_party/libopenjpeg20/tcd.c
4+++ b/third_party/libopenjpeg20/tcd.c
5@@ -706,9 +706,16 @@ static INLINE OPJ_BOOL opj_tcd_init_tile(opj_tcd_t *p_tcd, OPJ_UINT32 p_tile_no,
6 	l_tx0 = l_cp->tx0 + p * l_cp->tdx; /* can't be greater than l_image->x1 so won't overflow */
7 	l_tile->x0 = (OPJ_INT32)opj_uint_max(l_tx0, l_image->x0);
8 	l_tile->x1 = (OPJ_INT32)opj_uint_min(opj_uint_adds(l_tx0, l_cp->tdx), l_image->x1);
9+	if (l_tile->x0 < 0 || l_tile->x1 < 0) {
10+		return OPJ_FALSE;
11+	}
12+
13 	l_ty0 = l_cp->ty0 + q * l_cp->tdy; /* can't be greater than l_image->y1 so won't overflow */
14 	l_tile->y0 = (OPJ_INT32)opj_uint_max(l_ty0, l_image->y0);
15 	l_tile->y1 = (OPJ_INT32)opj_uint_min(opj_uint_adds(l_ty0, l_cp->tdy), l_image->y1);
16+	if (l_tile->y0 < 0 || l_tile->y1 < 0) {
17+		return OPJ_FALSE;
18+	}
19
20 	/* testcase 1888.pdf.asan.35.988 */
21 	if (l_tccp->numresolutions == 0) {
22