Cherry pick another OpenJPEG fix for a DWT integer overflow.
Apply OpenJPEG's commit 1462e9403fb7d1186e999701dfe72980262a089c to the
local copy of OpenJPEG.
Bug: chromium:1307852
Change-Id: I5148987e055132549d4ac83f27746dd372c885f9
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/91650
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
diff --git a/third_party/libopenjpeg20/0042-dwt_overflows.patch b/third_party/libopenjpeg20/0042-dwt_overflows.patch
new file mode 100644
index 0000000..9ad27ae
--- /dev/null
+++ b/third_party/libopenjpeg20/0042-dwt_overflows.patch
@@ -0,0 +1,20 @@
+commit 1462e9403fb7d1186e999701dfe72980262a089c
+Author: Even Rouault <even.rouault@spatialys.com>
+Date: Thu Feb 10 14:30:13 2022 +0100
+
+ Avoid integer overflows in DWT. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44544
+
+diff --git a/src/lib/openjp2/dwt.c b/src/lib/openjp2/dwt.c
+index 2b9b9e92..abc500ec 100644
+--- a/src/lib/openjp2/dwt.c
++++ b/src/lib/openjp2/dwt.c
+@@ -801,7 +801,8 @@ static void opj_idwt3_v_cas0(OPJ_INT32* tmp,
+ opj_int_add_no_overflow(opj_int_add_no_overflow(d1c, d1n), 2) >> 2);
+
+ tmp[i ] = s0c;
+- tmp[i + 1] = d1c + ((s0c + s0n) >> 1);
++ tmp[i + 1] = opj_int_add_no_overflow(d1c, opj_int_add_no_overflow(s0c,
++ s0n) >> 1);
+ }
+
+ tmp[i] = s0n;
diff --git a/third_party/libopenjpeg20/README.pdfium b/third_party/libopenjpeg20/README.pdfium
index 30bbd34..d6127b0 100644
--- a/third_party/libopenjpeg20/README.pdfium
+++ b/third_party/libopenjpeg20/README.pdfium
@@ -30,3 +30,4 @@
0039-opj_mqc_renorme.patch: Remove unused opj_mqc_renorme().
0040-dwt_overflows.patch: Avoid integer overflows in DWT.
0041-remove_opj_clock.patch: Remove unused opj_clock.h include.
+0042-dwt_overflows.patch: Avoid integer overflows in DWT.
diff --git a/third_party/libopenjpeg20/dwt.c b/third_party/libopenjpeg20/dwt.c
index 67a0b9f..063a689 100644
--- a/third_party/libopenjpeg20/dwt.c
+++ b/third_party/libopenjpeg20/dwt.c
@@ -806,7 +806,8 @@
opj_int_add_no_overflow(opj_int_add_no_overflow(d1c, d1n), 2) >> 2);
tmp[i ] = s0c;
- tmp[i + 1] = d1c + ((s0c + s0n) >> 1);
+ tmp[i + 1] = opj_int_add_no_overflow(d1c, opj_int_add_no_overflow(s0c,
+ s0n) >> 1);
}
tmp[i] = s0n;
