Avoid integer overflows in DWT. Fixes https://bugs.chromium.org/p/oss-fuzz/issues...

diff --git a/src/lib/openjp2/dwt.c b/src/lib/openjp2/dwt.c
index 2b9b9e9245c5f30dc283d382e8b5a3e63f255a66..abc500eca6bb27e6eb8e87a08b524448d0a10b6a 100644 (file)
--- a/src/lib/openjp2/dwt.c
+++ b/src/lib/openjp2/dwt.c
@@ -801,7 +801,8 @@ static void opj_idwt3_v_cas0(OPJ_INT32* tmp,
                                       opj_int_add_no_overflow(opj_int_add_no_overflow(d1c, d1n), 2) >> 2);
 
         tmp[i  ] = s0c;
-        tmp[i + 1] = d1c + ((s0c + s0n) >> 1);
+        tmp[i + 1] = opj_int_add_no_overflow(d1c, opj_int_add_no_overflow(s0c,
+                                             s0n) >> 1);
     }
 
     tmp[i] = s0n;