| diff --git a/third_party/libopenjpeg20/t1.c b/third_party/libopenjpeg20/t1.c | |
| index 1ad850c77..d290c38d5 100644 | |
| --- a/third_party/libopenjpeg20/t1.c | |
| +++ b/third_party/libopenjpeg20/t1.c | |
| @@ -1387,6 +1387,9 @@ static OPJ_BOOL opj_t1_decode_cblk(opj_t1_t *t1, | |
| } | |
| bpno_plus_one = (OPJ_INT32)(roishift + cblk->numbps); | |
| + if (bpno_plus_one > 30) { | |
| + return OPJ_FALSE; | |
| + } | |
| passtype = 2; | |
| opj_mqc_resetstates(mqc); |