[trunk] added overflow checks (fixes issue 431)

Thanks mdarbois

1 files changed, 9 insertions, 4 deletions

diff --git a/src/lib/openjp2/pi.c b/src/lib/openjp2/pi.c
index 66e5b05c..393a1e55 100644
--- a/src/lib/openjp2/pi.c
+++ b/src/lib/openjp2/pi.c
@@ -693,6 +693,9 @@ void opj_get_all_encoding_parameters(   const opj_image_t *p_image,
 	/* position in x and y of tile*/
 	OPJ_UINT32 p, q;
 
+	/* non-corrected (in regard to image offset) tile offset */
+	OPJ_UINT32 l_tx0, l_ty0;
+
 	/* preconditions in debug*/
 	assert(p_cp != 00);
 	assert(p_image != 00);
@@ -708,10 +711,12 @@ void opj_get_all_encoding_parameters(   const opj_image_t *p_image,
 	q = tileno / p_cp->tw;
 
 	/* here calculation of tx0, tx1, ty0, ty1, maxprec, l_dx and l_dy */
-	*p_tx0 = (OPJ_INT32)opj_uint_max(p_cp->tx0 + p * p_cp->tdx, p_image->x0);
-	*p_tx1 = (OPJ_INT32)opj_uint_min(p_cp->tx0 + (p + 1) * p_cp->tdx, p_image->x1);
-	*p_ty0 = (OPJ_INT32)opj_uint_max(p_cp->ty0 + q * p_cp->tdy, p_image->y0);
-	*p_ty1 = (OPJ_INT32)opj_uint_min(p_cp->ty0 + (q + 1) * p_cp->tdy, p_image->y1);
+	l_tx0 = p_cp->tx0 + p * p_cp->tdx; /* can't be greater than p_image->x1 so won't overflow */
+	*p_tx0 = (OPJ_INT32)opj_uint_max(l_tx0, p_image->x0);
+	*p_tx1 = (OPJ_INT32)opj_uint_min(opj_uint_adds(l_tx0, p_cp->tdx), p_image->x1);
+	l_ty0 = p_cp->ty0 + q * p_cp->tdy; /* can't be greater than p_image->y1 so won't overflow */
+	*p_ty0 = (OPJ_INT32)opj_uint_max(l_ty0, p_image->y0);
+	*p_ty1 = (OPJ_INT32)opj_uint_min(opj_uint_adds(l_ty0, p_cp->tdy), p_image->y1);
 
 	/* max precision and resolution is 0 (can only grow)*/
 	*p_max_prec = 0;