blob: 58f04b0a24334bfc445e9e6afb54b540d656a986 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
|
diff --git a/third_party/libopenjpeg20/t1.c b/third_party/libopenjpeg20/t1.c
index 1ad850c77..d290c38d5 100644
--- a/third_party/libopenjpeg20/t1.c
+++ b/third_party/libopenjpeg20/t1.c
@@ -1387,6 +1387,9 @@ static OPJ_BOOL opj_t1_decode_cblk(opj_t1_t *t1,
}
bpno_plus_one = (OPJ_INT32)(roishift + cblk->numbps);
+ if (bpno_plus_one > 30) {
+ return OPJ_FALSE;
+ }
passtype = 2;
opj_mqc_resetstates(mqc);
|