bucket_A0/jasper

   1 # Buildsheet autogenerated by ravenadm tool -- Do not edit.
   2
   3 NAMEBASE=               jasper
   4 VERSION=                1.900.1
   5 KEYWORDS=               graphics
   6 VARIANTS=               standard
   7 SDESC[standard]=        Implementation JPEG-2000 standard codec
   8 HOMEPAGE=               http://www.ece.uvic.ca/~frodo/jasper/
   9 CONTACT=                nobody
  10
  11 DOWNLOAD_GROUPS=        main
  12 SITES[main]=            http://www.ece.uvic.ca/~mdadams/jasper/software/
  13                         ftp://ftp.imagemagick.org/pub/ImageMagick/delegates/
  14 DISTFILE[1]=            jasper-1.900.1.zip:main
  15 DF_INDEX=               1
  16 SPKGS[standard]=        complete
  17                         primary
  18                         docs
  19
  20 OPTIONS_AVAILABLE=      none
  21 OPTIONS_STANDARD=       none
  22
  23 BUILDRUN_DEPENDS=       freeglut:primary:standard
  24
  25 USES=                   jpeg libtool:keepla fbsd10fix
  26 XORG_COMPONENTS=        x11 xext xi xmu
  27
  28 FPC_EQUIVALENT=         graphics/jasper
  29
  30 MUST_CONFIGURE=         gnu
  31 CONFIGURE_ARGS=         --enable-shared
  32                         --enable-static
  33                         --enable-opengl
  34
  35 INSTALL_TARGET=         install-strip
  36
  37 post-install:
  38         ${MKDIR} ${STAGEDIR}${STD_DOCDIR}/
  39         ${INSTALL_DATA} ${WRKSRC}/doc/* ${STAGEDIR}${STD_DOCDIR}/
  40
  41 [FILE:1040:descriptions/desc.primary]
  42 The JasPer Project is an open-source initiative to provide a free
  43 software-based reference implementation of the codec specified in the
  44 JPEG-2000 Part-1 standard (i.e., ISO/IEC 15444-1). This project was
  45 started as a collaborative effort between Image Power, Inc. and the
  46 University of British Columbia. Presently, the ongoing maintenance and
  47 development of the JasPer software is being coordinated by its principal
  48 author, Michael Adams, who is affiliated with the Digital Signal
  49 Processing Group (DSPG) in the Department of Electrical and Computer
  50 Engineering at the University of Victoria.
  51
  52 JasPer includes a software-based implementation of the codec specified in
  53 the JPEG-2000 Part-1 standard (i.e., ISO/IEC 15444-1). The JasPer software
  54 is written in the C programming language. More details about this software
  55 can be found in the JasPer Software Reference Manual.
  56
  57 The JasPer software has been included in the JPEG-2000 Part-5 standard
  58 (i.e., ISO/IEC 15444-5), as an official reference implementation of the
  59 JPEG-2000 Part-1 codec.
  60
  61
  62 [FILE:97:distinfo]
  63 6b905a9c2aca2e275544212666eefc4eb44d95d0a57e4305457b407fe63f9494      1415752 jasper-1.900.1.zip
  64
  65
  66 [FILE:446:manifests/plist.primary]
  67 bin/
  68  imgcmp
  69  imginfo
  70  jasper
  71  tmrdemo
  72  jiv
  73 include/jasper/
  74  jas_cm.h
  75  jas_config.h
  76  jas_config2.h
  77  jas_debug.h
  78  jas_fix.h
  79  jas_getopt.h
  80  jas_icc.h
  81  jas_image.h
  82  jas_init.h
  83  jas_malloc.h
  84  jas_math.h
  85  jas_seq.h
  86  jas_stream.h
  87  jas_string.h
  88  jas_tmr.h
  89  jas_tvp.h
  90  jas_types.h
  91  jas_version.h
  92  jasper.h
  93 lib/
  94  libjasper.a
  95  libjasper.la
  96  libjasper.so
  97  libjasper.so.4
  98  libjasper.so.4.0.0
  99 share/man/man1/
 100  imgcmp.1.gz
 101  imginfo.1.gz
 102  jasper.1.gz
 103  jiv.1.gz
 104
 105
 106 [FILE:52:manifests/plist.docs]
 107 share/doc/jasper/
 108  README
 109  jasper.pdf
 110  jpeg2000.pdf
 111
 112
 113 [FILE:1002:patches/patch-atexit]
 114 When compiling with gcc don't register jas_cleanup with atexit.
 115 Instead, mark it as a destructor using a gcc-only extension.
 116
 117 This will avoid crashes, when an application, which has explicitly
 118 dlclosed() libjasper, exits.
 119
 120 If a similar method exists for other compilers, it should be used
 121 too.  Or, maybe, something can be done with __cxa_atexit() here...
 122
 123         -mi
 124
 125 --- src/libjasper/include/jasper/jas_init.h     2007-01-19 16:43:04.000000000 -0500
 126 +++ src/libjasper/include/jasper/jas_init.h     2007-08-05 11:42:41.000000000 -0400
 127 @@ -75,5 +75,9 @@
 128  int jas_init(void);
 129
 130 +#ifdef __GNUC__
 131 +void jas_cleanup(void) __attribute__ ((destructor));
 132 +#else
 133  void jas_cleanup(void);
 134 +#endif
 135
 136  #ifdef __cplusplus
 137 --- src/libjasper/base/jas_init.c       2007-01-19 16:43:05.000000000 -0500
 138 +++ src/libjasper/base/jas_init.c       2007-08-05 11:44:00.000000000 -0400
 139 @@ -152,5 +152,4 @@
 140         as it ensures that the JasPer exit handler is called before the
 141         debug memory allocator exit handler. */
 142 -       atexit(jas_cleanup);
 143
 144         return 0;
 145
 146
 147 [FILE:377:patches/patch-bmp_dec.c]
 148 --- src/libjasper/bmp/bmp_dec.c.orig    2007-01-19 22:43:07.000000000 +0100
 149 +++ src/libjasper/bmp/bmp_dec.c 2013-04-17 22:32:23.000000000 +0200
 150 @@ -283,7 +283,7 @@
 151         }
 152
 153         if (info->numcolors > 0) {
 154 -               if (!(info->palents = jas_malloc(info->numcolors *
 155 +               if (!(info->palents = jas_malloc2(info->numcolors,
 156                   sizeof(bmp_palent_t)))) {
 157                         bmp_info_destroy(info);
 158                         return 0;
 159
 160
 161 [FILE:1580:patches/patch-jas_cm.c]
 162 --- src/libjasper/base/jas_cm.c.orig    2007-01-19 22:43:05.000000000 +0100
 163 +++ src/libjasper/base/jas_cm.c 2013-04-17 22:32:23.000000000 +0200
 164 @@ -704,8 +704,7 @@
 165  {
 166         jas_cmpxform_t **p;
 167         assert(n >= pxformseq->numpxforms);
 168 -       p = (!pxformseq->pxforms) ? jas_malloc(n * sizeof(jas_cmpxform_t *)) :
 169 -         jas_realloc(pxformseq->pxforms, n * sizeof(jas_cmpxform_t *));
 170 +       p = jas_realloc2(pxformseq->pxforms, n, sizeof(jas_cmpxform_t *));
 171         if (!p) {
 172                 return -1;
 173         }
 174 @@ -889,13 +888,13 @@
 175         jas_cmshapmatlut_cleanup(lut);
 176         if (curv->numents == 0) {
 177                 lut->size = 2;
 178 -               if (!(lut->data = jas_malloc(lut->size * sizeof(jas_cmreal_t))))
 179 +               if (!(lut->data = jas_malloc2(lut->size, sizeof(jas_cmreal_t))))
 180                         goto error;
 181                 lut->data[0] = 0.0;
 182                 lut->data[1] = 1.0;
 183         } else if (curv->numents == 1) {
 184                 lut->size = 256;
 185 -               if (!(lut->data = jas_malloc(lut->size * sizeof(jas_cmreal_t))))
 186 +               if (!(lut->data = jas_malloc2(lut->size, sizeof(jas_cmreal_t))))
 187                         goto error;
 188                 gamma = curv->ents[0] / 256.0;
 189                 for (i = 0; i < lut->size; ++i) {
 190 @@ -903,7 +902,7 @@
 191                 }
 192         } else {
 193                 lut->size = curv->numents;
 194 -               if (!(lut->data = jas_malloc(lut->size * sizeof(jas_cmreal_t))))
 195 +               if (!(lut->data = jas_malloc2(lut->size, sizeof(jas_cmreal_t))))
 196                         goto error;
 197                 for (i = 0; i < lut->size; ++i) {
 198                         lut->data[i] = curv->ents[i] / 65535.0;
 199 @@ -953,7 +952,7 @@
 200                         return -1;
 201                 }
 202         }
 203 -       if (!(invlut->data = jas_malloc(n * sizeof(jas_cmreal_t))))
 204 +       if (!(invlut->data = jas_malloc2(n, sizeof(jas_cmreal_t))))
 205                 return -1;
 206         invlut->size = n;
 207         for (i = 0; i < invlut->size; ++i) {
 208
 209
 210 [FILE:4701:patches/patch-jas_icc.c]
 211 --- src/libjasper/base/jas_icc.c.orig   2007-01-19 22:43:05.000000000 +0100
 212 +++ src/libjasper/base/jas_icc.c        2016-02-20 13:49:45.521860000 +0100
 213 @@ -373,7 +373,7 @@
 214         jas_icctagtab_t *tagtab;
 215
 216         tagtab = &prof->tagtab;
 217 -       if (!(tagtab->ents = jas_malloc(prof->attrtab->numattrs *
 218 +       if (!(tagtab->ents = jas_malloc2(prof->attrtab->numattrs,
 219           sizeof(jas_icctagtabent_t))))
 220                 goto error;
 221         tagtab->numents = prof->attrtab->numattrs;
 222 @@ -522,7 +522,7 @@
 223         }
 224         if (jas_iccgetuint32(in, &tagtab->numents))
 225                 goto error;
 226 -       if (!(tagtab->ents = jas_malloc(tagtab->numents *
 227 +       if (!(tagtab->ents = jas_malloc2(tagtab->numents,
 228           sizeof(jas_icctagtabent_t))))
 229                 goto error;
 230         tagtabent = tagtab->ents;
 231 @@ -743,8 +743,7 @@
 232  {
 233         jas_iccattr_t *newattrs;
 234         assert(maxents >= tab->numattrs);
 235 -       newattrs = tab->attrs ? jas_realloc(tab->attrs, maxents *
 236 -         sizeof(jas_iccattr_t)) : jas_malloc(maxents * sizeof(jas_iccattr_t));
 237 +       newattrs = jas_realloc2(tab->attrs, maxents, sizeof(jas_iccattr_t));
 238         if (!newattrs)
 239                 return -1;
 240         tab->attrs = newattrs;
 241 @@ -999,7 +998,7 @@
 242
 243         if (jas_iccgetuint32(in, &curv->numents))
 244                 goto error;
 245 -       if (!(curv->ents = jas_malloc(curv->numents * sizeof(jas_iccuint16_t))))
 246 +       if (!(curv->ents = jas_malloc2(curv->numents, sizeof(jas_iccuint16_t))))
 247                 goto error;
 248         for (i = 0; i < curv->numents; ++i) {
 249                 if (jas_iccgetuint16(in, &curv->ents[i]))
 250 @@ -1011,7 +1010,6 @@
 251         return 0;
 252
 253  error:
 254 -       jas_icccurv_destroy(attrval);
 255         return -1;
 256  }
 257
 258 @@ -1100,7 +1098,7 @@
 259         if (jas_iccgetuint32(in, &txtdesc->uclangcode) ||
 260           jas_iccgetuint32(in, &txtdesc->uclen))
 261                 goto error;
 262 -       if (!(txtdesc->ucdata = jas_malloc(txtdesc->uclen * 2)))
 263 +       if (!(txtdesc->ucdata = jas_malloc2(txtdesc->uclen, 2)))
 264                 goto error;
 265         if (jas_stream_read(in, txtdesc->ucdata, txtdesc->uclen * 2) !=
 266           JAS_CAST(int, txtdesc->uclen * 2))
 267 @@ -1129,7 +1127,6 @@
 268  #endif
 269         return 0;
 270  error:
 271 -       jas_icctxtdesc_destroy(attrval);
 272         return -1;
 273  }
 274
 275 @@ -1208,8 +1205,6 @@
 276                 goto error;
 277         return 0;
 278  error:
 279 -       if (txt->string)
 280 -               jas_free(txt->string);
 281         return -1;
 282  }
 283
 284 @@ -1292,17 +1287,17 @@
 285           jas_iccgetuint16(in, &lut8->numouttabents))
 286                 goto error;
 287         clutsize = jas_iccpowi(lut8->clutlen, lut8->numinchans) * lut8->numoutchans;
 288 -       if (!(lut8->clut = jas_malloc(clutsize * sizeof(jas_iccuint8_t))) ||
 289 -         !(lut8->intabsbuf = jas_malloc(lut8->numinchans *
 290 -         lut8->numintabents * sizeof(jas_iccuint8_t))) ||
 291 -         !(lut8->intabs = jas_malloc(lut8->numinchans *
 292 +       if (!(lut8->clut = jas_malloc2(clutsize, sizeof(jas_iccuint8_t))) ||
 293 +         !(lut8->intabsbuf = jas_malloc3(lut8->numinchans,
 294 +         lut8->numintabents, sizeof(jas_iccuint8_t))) ||
 295 +         !(lut8->intabs = jas_malloc2(lut8->numinchans,
 296           sizeof(jas_iccuint8_t *))))
 297                 goto error;
 298         for (i = 0; i < lut8->numinchans; ++i)
 299                 lut8->intabs[i] = &lut8->intabsbuf[i * lut8->numintabents];
 300 -       if (!(lut8->outtabsbuf = jas_malloc(lut8->numoutchans *
 301 -         lut8->numouttabents * sizeof(jas_iccuint8_t))) ||
 302 -         !(lut8->outtabs = jas_malloc(lut8->numoutchans *
 303 +       if (!(lut8->outtabsbuf = jas_malloc3(lut8->numoutchans,
 304 +         lut8->numouttabents, sizeof(jas_iccuint8_t))) ||
 305 +         !(lut8->outtabs = jas_malloc2(lut8->numoutchans,
 306           sizeof(jas_iccuint8_t *))))
 307                 goto error;
 308         for (i = 0; i < lut8->numoutchans; ++i)
 309 @@ -1330,7 +1325,6 @@
 310                 goto error;
 311         return 0;
 312  error:
 313 -       jas_icclut8_destroy(attrval);
 314         return -1;
 315  }
 316
 317 @@ -1461,17 +1455,17 @@
 318           jas_iccgetuint16(in, &lut16->numouttabents))
 319                 goto error;
 320         clutsize = jas_iccpowi(lut16->clutlen, lut16->numinchans) * lut16->numoutchans;
 321 -       if (!(lut16->clut = jas_malloc(clutsize * sizeof(jas_iccuint16_t))) ||
 322 -         !(lut16->intabsbuf = jas_malloc(lut16->numinchans *
 323 -         lut16->numintabents * sizeof(jas_iccuint16_t))) ||
 324 -         !(lut16->intabs = jas_malloc(lut16->numinchans *
 325 +       if (!(lut16->clut = jas_malloc2(clutsize, sizeof(jas_iccuint16_t))) ||
 326 +         !(lut16->intabsbuf = jas_malloc3(lut16->numinchans,
 327 +         lut16->numintabents, sizeof(jas_iccuint16_t))) ||
 328 +         !(lut16->intabs = jas_malloc2(lut16->numinchans,
 329           sizeof(jas_iccuint16_t *))))
 330                 goto error;
 331         for (i = 0; i < lut16->numinchans; ++i)
 332                 lut16->intabs[i] = &lut16->intabsbuf[i * lut16->numintabents];
 333 -       if (!(lut16->outtabsbuf = jas_malloc(lut16->numoutchans *
 334 -         lut16->numouttabents * sizeof(jas_iccuint16_t))) ||
 335 -         !(lut16->outtabs = jas_malloc(lut16->numoutchans *
 336 +       if (!(lut16->outtabsbuf = jas_malloc3(lut16->numoutchans,
 337 +         lut16->numouttabents, sizeof(jas_iccuint16_t))) ||
 338 +         !(lut16->outtabs = jas_malloc2(lut16->numoutchans,
 339           sizeof(jas_iccuint16_t *))))
 340                 goto error;
 341         for (i = 0; i < lut16->numoutchans; ++i)
 342 @@ -1499,7 +1493,6 @@
 343                 goto error;
 344         return 0;
 345  error:
 346 -       jas_icclut16_destroy(attrval);
 347         return -1;
 348  }
 349
 350
 351
 352 [FILE:1187:patches/patch-jas_image.c]
 353 --- src/libjasper/base/jas_image.c.orig 2007-01-19 22:43:05.000000000 +0100
 354 +++ src/libjasper/base/jas_image.c      2016-02-20 13:59:00.999124000 +0100
 355 @@ -142,7 +142,7 @@
 356         image->inmem_ = true;
 357
 358         /* Allocate memory for the per-component information. */
 359 -       if (!(image->cmpts_ = jas_malloc(image->maxcmpts_ *
 360 +       if (!(image->cmpts_ = jas_malloc2(image->maxcmpts_,
 361           sizeof(jas_image_cmpt_t *)))) {
 362                 jas_image_destroy(image);
 363                 return 0;
 364 @@ -426,6 +426,10 @@
 365                 return -1;
 366         }
 367
 368 +       if (!data->rows_) {
 369 +               return -1;
 370 +       }
 371 +
 372         if (jas_matrix_numrows(data) != height || jas_matrix_numcols(data) != width) {
 373                 if (jas_matrix_resize(data, height, width)) {
 374                         return -1;
 375 @@ -479,6 +483,10 @@
 376                 return -1;
 377         }
 378
 379 +       if (!data->rows_) {
 380 +               return -1;
 381 +       }
 382 +
 383         if (jas_matrix_numrows(data) != height || jas_matrix_numcols(data) != width) {
 384                 return -1;
 385         }
 386 @@ -774,8 +782,7 @@
 387         jas_image_cmpt_t **newcmpts;
 388         int cmptno;
 389
 390 -       newcmpts = (!image->cmpts_) ? jas_malloc(maxcmpts * sizeof(jas_image_cmpt_t *)) :
 391 -         jas_realloc(image->cmpts_, maxcmpts * sizeof(jas_image_cmpt_t *));
 392 +       newcmpts = jas_realloc2(image->cmpts_, maxcmpts, sizeof(jas_image_cmpt_t *));
 393         if (!newcmpts) {
 394                 return -1;
 395         }
 396
 397
 398 [FILE:1347:patches/patch-jas_malloc.c]
 399 --- src/libjasper/base/jas_malloc.c.orig        2007-01-19 22:43:05.000000000 +0100
 400 +++ src/libjasper/base/jas_malloc.c     2013-04-17 22:43:09.000000000 +0200
 401 @@ -76,6 +76,9 @@
 402
 403  /* We need the prototype for memset. */
 404  #include <string.h>
 405 +#include <limits.h>
 406 +#include <errno.h>
 407 +#include <stdint.h>
 408
 409  #include "jasper/jas_malloc.h"
 410
 411 @@ -113,19 +116,51 @@
 412
 413  void *jas_realloc(void *ptr, size_t size)
 414  {
 415 -       return realloc(ptr, size);
 416 +       return ptr ? realloc(ptr, size) : malloc(size);
 417  }
 418
 419  void *jas_calloc(size_t nmemb, size_t size)
 420  {
 421         void *ptr;
 422 +
 423 +       ptr = jas_malloc2(nmemb, size);
 424 +       if (ptr)
 425 +               memset(ptr, 0, nmemb*size);
 426 +       return ptr;
 427 +}
 428 +
 429 +void *jas_realloc2(void *ptr, size_t nmemb, size_t size)
 430 +{
 431 +       if (!ptr)
 432 +               return jas_malloc2(nmemb, size);
 433 +       if (nmemb && SIZE_MAX / nmemb < size) {
 434 +               errno = ENOMEM;
 435 +               return NULL;
 436 +       }
 437 +       return jas_realloc(ptr, nmemb * size);
 438 +
 439 +}
 440 +
 441 +void *jas_malloc2(size_t nmemb, size_t size)
 442 +{
 443 +       if (nmemb && SIZE_MAX / nmemb < size) {
 444 +               errno = ENOMEM;
 445 +               return NULL;
 446 +       }
 447 +
 448 +       return jas_malloc(nmemb * size);
 449 +}
 450 +
 451 +void *jas_malloc3(size_t a, size_t b, size_t c)
 452 +{
 453         size_t n;
 454 -       n = nmemb * size;
 455 -       if (!(ptr = jas_malloc(n * sizeof(char)))) {
 456 -               return 0;
 457 +
 458 +       if (a && SIZE_MAX / a < b) {
 459 +               errno = ENOMEM;
 460 +               return NULL;
 461         }
 462 -       memset(ptr, 0, n);
 463 -       return ptr;
 464 +
 465 +       return jas_malloc2(a*b, c);
 466  }
 467
 468  #endif
 469
 470
 471 [FILE:860:patches/patch-jas_malloc.h]
 472 --- src/libjasper/include/jasper/jas_malloc.h.orig      2007-01-19 22:43:04.000000000 +0100
 473 +++ src/libjasper/include/jasper/jas_malloc.h   2013-04-17 22:16:16.000000000 +0200
 474 @@ -95,6 +95,9 @@
 475  #define        jas_free        MEMFREE
 476  #define        jas_realloc     MEMREALLOC
 477  #define        jas_calloc      MEMCALLOC
 478 +#define        jas_malloc2(a, b)       MEMALLOC((a)*(b))
 479 +#define        jas_malloc3(a, b, c)    MEMALLOC((a)*(b)*(c))
 480 +#define        jas_realloc2(p, a, b)   MEMREALLOC((p), (a)*(b))
 481  #endif
 482
 483  /******************************************************************************\
 484 @@ -115,6 +118,13 @@
 485  /* Allocate a block of memory and initialize the contents to zero. */
 486  void *jas_calloc(size_t nmemb, size_t size);
 487
 488 +/* size-checked double allocation .*/
 489 +void *jas_malloc2(size_t, size_t);
 490 +
 491 +void *jas_malloc3(size_t, size_t, size_t);
 492 +
 493 +void *jas_realloc2(void *, size_t, size_t);
 494 +
 495  #endif
 496
 497  #ifdef __cplusplus
 498
 499
 500 [FILE:2200:patches/patch-jas_seq.c]
 501 --- src/libjasper/base/jas_seq.c.orig   2007-01-19 22:43:05.000000000 +0100
 502 +++ src/libjasper/base/jas_seq.c        2016-02-20 13:59:01.014091000 +0100
 503 @@ -114,7 +114,7 @@
 504         matrix->datasize_ = numrows * numcols;
 505
 506         if (matrix->maxrows_ > 0) {
 507 -               if (!(matrix->rows_ = jas_malloc(matrix->maxrows_ *
 508 +               if (!(matrix->rows_ = jas_malloc2(matrix->maxrows_,
 509                   sizeof(jas_seqent_t *)))) {
 510                         jas_matrix_destroy(matrix);
 511                         return 0;
 512 @@ -122,7 +122,7 @@
 513         }
 514
 515         if (matrix->datasize_ > 0) {
 516 -               if (!(matrix->data_ = jas_malloc(matrix->datasize_ *
 517 +               if (!(matrix->data_ = jas_malloc2(matrix->datasize_,
 518                   sizeof(jas_seqent_t)))) {
 519                         jas_matrix_destroy(matrix);
 520                         return 0;
 521 @@ -220,7 +220,7 @@
 522         mat0->numrows_ = r1 - r0 + 1;
 523         mat0->numcols_ = c1 - c0 + 1;
 524         mat0->maxrows_ = mat0->numrows_;
 525 -       mat0->rows_ = jas_malloc(mat0->maxrows_ * sizeof(jas_seqent_t *));
 526 +       mat0->rows_ = jas_malloc2(mat0->maxrows_, sizeof(jas_seqent_t *));
 527         for (i = 0; i < mat0->numrows_; ++i) {
 528                 mat0->rows_[i] = mat1->rows_[r0 + i] + c0;
 529         }
 530 @@ -262,6 +262,10 @@
 531         int rowstep;
 532         jas_seqent_t *data;
 533
 534 +       if (!matrix->rows_) {
 535 +               return;
 536 +       }
 537 +
 538         rowstep = jas_matrix_rowstep(matrix);
 539         for (i = matrix->numrows_, rowstart = matrix->rows_[0]; i > 0; --i,
 540           rowstart += rowstep) {
 541 @@ -282,6 +286,10 @@
 542         jas_seqent_t *data;
 543         int rowstep;
 544
 545 +       if (!matrix->rows_) {
 546 +               return;
 547 +       }
 548 +
 549         rowstep = jas_matrix_rowstep(matrix);
 550         for (i = matrix->numrows_, rowstart = matrix->rows_[0]; i > 0; --i,
 551           rowstart += rowstep) {
 552 @@ -306,6 +314,10 @@
 553         int rowstep;
 554         jas_seqent_t *data;
 555
 556 +       if (!matrix->rows_) {
 557 +               return;
 558 +       }
 559 +
 560         assert(n >= 0);
 561         rowstep = jas_matrix_rowstep(matrix);
 562         for (i = matrix->numrows_, rowstart = matrix->rows_[0]; i > 0; --i,
 563 @@ -325,6 +337,10 @@
 564         int rowstep;
 565         jas_seqent_t *data;
 566
 567 +       if (!matrix->rows_) {
 568 +               return;
 569 +       }
 570 +
 571         rowstep = jas_matrix_rowstep(matrix);
 572         for (i = matrix->numrows_, rowstart = matrix->rows_[0]; i > 0; --i,
 573           rowstart += rowstep) {
 574 @@ -367,6 +383,10 @@
 575         int rowstep;
 576         jas_seqent_t *data;
 577
 578 +       if (!matrix->rows_) {
 579 +               return;
 580 +       }
 581 +
 582         rowstep = jas_matrix_rowstep(matrix);
 583         for (i = matrix->numrows_, rowstart = matrix->rows_[0]; i > 0; --i,
 584           rowstart += rowstep) {
 585
 586
 587 [FILE:2127:patches/patch-jas_stream.c]
 588 --- src/libjasper/base/jas_stream.c.orig        2007-01-19 22:43:05.000000000 +0100
 589 +++ src/libjasper/base/jas_stream.c     2015-08-29 08:07:01.000000000 +0200
 590 @@ -99,7 +99,7 @@
 591  static void jas_stream_destroy(jas_stream_t *stream);
 592  static jas_stream_t *jas_stream_create(void);
 593  static void jas_stream_initbuf(jas_stream_t *stream, int bufmode, char *buf,
 594 -  int bufsize);
 595 +  size_t bufsize);
 596
 597  static int mem_read(jas_stream_obj_t *obj, char *buf, int cnt);
 598  static int mem_write(jas_stream_obj_t *obj, char *buf, int cnt);
 599 @@ -168,7 +168,7 @@
 600         return stream;
 601  }
 602
 603 -jas_stream_t *jas_stream_memopen(char *buf, int bufsize)
 604 +jas_stream_t *jas_stream_memopen(char *buf, size_t bufsize)
 605  {
 606         jas_stream_t *stream;
 607         jas_stream_memobj_t *obj;
 608 @@ -361,15 +361,14 @@
 609         }
 610         obj->fd = -1;
 611         obj->flags = 0;
 612 -       obj->pathname[0] = '\0';
 613 +       snprintf(obj->pathname, sizeof(obj->pathname), "/tmp/jasper.XXXXXX");
 614         stream->obj_ = obj;
 615
 616         /* Choose a file name. */
 617 -       tmpnam(obj->pathname);
 618 +       obj->fd = mkstemp(obj->pathname);
 619
 620         /* Open the underlying file. */
 621 -       if ((obj->fd = open(obj->pathname, O_CREAT | O_EXCL | O_RDWR | O_TRUNC | O_BINARY,
 622 -         JAS_STREAM_PERMS)) < 0) {
 623 +       if (obj->fd < 0) {
 624                 jas_stream_destroy(stream);
 625                 return 0;
 626         }
 627 @@ -553,7 +552,7 @@
 628         int ret;
 629
 630         va_start(ap, fmt);
 631 -       ret = vsprintf(buf, fmt, ap);
 632 +       ret = vsnprintf(buf, sizeof(buf), fmt, ap);
 633         jas_stream_puts(stream, buf);
 634         va_end(ap);
 635         return ret;
 636 @@ -570,7 +569,7 @@
 637         return 0;
 638  }
 639
 640 -char *jas_stream_gets(jas_stream_t *stream, char *buf, int bufsize)
 641 +char *jas_stream_gets(jas_stream_t *stream, char *buf, size_t bufsize)
 642  {
 643         int c;
 644         char *bufptr;
 645 @@ -694,7 +693,7 @@
 646  \******************************************************************************/
 647
 648  static void jas_stream_initbuf(jas_stream_t *stream, int bufmode, char *buf,
 649 -  int bufsize)
 650 +  size_t bufsize)
 651  {
 652         /* If this function is being called, the buffer should not have been
 653           initialized yet. */
 654 @@ -987,7 +986,7 @@
 655         return cnt;
 656  }
 657
 658 -static int mem_resize(jas_stream_memobj_t *m, int bufsize)
 659 +static int mem_resize(jas_stream_memobj_t *m, size_t bufsize)
 660  {
 661         unsigned char *buf;
 662
 663
 664
 665 [FILE:1262:patches/patch-jas_stream.h]
 666 --- src/libjasper/include/jasper/jas_stream.h.orig      2007-01-19 22:43:04.000000000 +0100
 667 +++ src/libjasper/include/jasper/jas_stream.h   2015-08-29 07:54:41.000000000 +0200
 668 @@ -215,7 +215,7 @@
 669         uchar *bufstart_;
 670
 671         /* The buffer size. */
 672 -       int bufsize_;
 673 +       size_t bufsize_;
 674
 675         /* The current position in the buffer. */
 676         uchar *ptr_;
 677 @@ -267,7 +267,7 @@
 678         uchar *buf_;
 679
 680         /* The allocated size of the buffer for holding file data. */
 681 -       int bufsize_;
 682 +       size_t bufsize_;
 683
 684         /* The length of the file. */
 685         int_fast32_t len_;
 686 @@ -291,7 +291,7 @@
 687  jas_stream_t *jas_stream_fopen(const char *filename, const char *mode);
 688
 689  /* Open a memory buffer as a stream. */
 690 -jas_stream_t *jas_stream_memopen(char *buf, int bufsize);
 691 +jas_stream_t *jas_stream_memopen(char *buf, size_t bufsize);
 692
 693  /* Open a file descriptor as a stream. */
 694  jas_stream_t *jas_stream_fdopen(int fd, const char *mode);
 695 @@ -366,7 +366,7 @@
 696  int jas_stream_puts(jas_stream_t *stream, const char *s);
 697
 698  /* Read a line of input from a stream. */
 699 -char *jas_stream_gets(jas_stream_t *stream, char *buf, int bufsize);
 700 +char *jas_stream_gets(jas_stream_t *stream, char *buf, size_t bufsize);
 701
 702  /* Look at the next character to be read from a stream without actually
 703    removing it from the stream. */
 704
 705
 706 [FILE:562:patches/patch-jas_types.h]
 707 --- src/libjasper/include/jasper/jas_types.h.orig       2007-01-19 22:43:04.000000000 +0100
 708 +++ src/libjasper/include/jasper/jas_types.h    2016-02-20 13:49:45.555375000 +0100
 709 @@ -179,13 +179,13 @@
 710  #endif
 711  /**********/
 712  #if !defined(INT_FAST64_MIN)
 713 -typedef longlong int_fast64_t;
 714 +typedef long long int_fast64_t;
 715  #define INT_FAST64_MIN LLONG_MIN
 716  #define INT_FAST64_MAX LLONG_MAX
 717  #endif
 718  /**********/
 719  #if !defined(UINT_FAST64_MAX)
 720 -typedef ulonglong uint_fast64_t;
 721 +typedef unsigned long long uint_fast64_t;
 722  #define UINT_FAST64_MAX        ULLONG_MAX
 723  #endif
 724  /**********/
 725
 726
 727 [FILE:2048:patches/patch-jp2_cod.c]
 728 --- src/libjasper/jp2/jp2_cod.c.orig    2007-01-19 22:43:05.000000000 +0100
 729 +++ src/libjasper/jp2/jp2_cod.c 2016-02-20 13:49:45.560559000 +0100
 730 @@ -247,7 +247,7 @@
 731         box = 0;
 732         tmpstream = 0;
 733
 734 -       if (!(box = jas_malloc(sizeof(jp2_box_t)))) {
 735 +       if (!(box = jas_calloc(1, sizeof(jp2_box_t)))) {
 736                 goto error;
 737         }
 738         box->ops = &jp2_boxinfo_unk.ops;
 739 @@ -372,7 +372,7 @@
 740         jp2_bpcc_t *bpcc = &box->data.bpcc;
 741         unsigned int i;
 742         bpcc->numcmpts = box->datalen;
 743 -       if (!(bpcc->bpcs = jas_malloc(bpcc->numcmpts * sizeof(uint_fast8_t)))) {
 744 +       if (!(bpcc->bpcs = jas_malloc2(bpcc->numcmpts, sizeof(uint_fast8_t)))) {
 745                 return -1;
 746         }
 747         for (i = 0; i < bpcc->numcmpts; ++i) {
 748 @@ -416,7 +416,7 @@
 749                 break;
 750         case JP2_COLR_ICC:
 751                 colr->iccplen = box->datalen - 3;
 752 -               if (!(colr->iccp = jas_malloc(colr->iccplen * sizeof(uint_fast8_t)))) {
 753 +               if (!(colr->iccp = jas_malloc2(colr->iccplen, sizeof(uint_fast8_t)))) {
 754                         return -1;
 755                 }
 756                 if (jas_stream_read(in, colr->iccp, colr->iccplen) != colr->iccplen) {
 757 @@ -453,7 +453,7 @@
 758         if (jp2_getuint16(in, &cdef->numchans)) {
 759                 return -1;
 760         }
 761 -       if (!(cdef->ents = jas_malloc(cdef->numchans * sizeof(jp2_cdefchan_t)))) {
 762 +       if (!(cdef->ents = jas_malloc2(cdef->numchans, sizeof(jp2_cdefchan_t)))) {
 763                 return -1;
 764         }
 765         for (channo = 0; channo < cdef->numchans; ++channo) {
 766 @@ -766,7 +766,7 @@
 767         unsigned int i;
 768
 769         cmap->numchans = (box->datalen) / 4;
 770 -       if (!(cmap->ents = jas_malloc(cmap->numchans * sizeof(jp2_cmapent_t)))) {
 771 +       if (!(cmap->ents = jas_malloc2(cmap->numchans, sizeof(jp2_cmapent_t)))) {
 772                 return -1;
 773         }
 774         for (i = 0; i < cmap->numchans; ++i) {
 775 @@ -828,10 +828,10 @@
 776                 return -1;
 777         }
 778         lutsize = pclr->numlutents * pclr->numchans;
 779 -       if (!(pclr->lutdata = jas_malloc(lutsize * sizeof(int_fast32_t)))) {
 780 +       if (!(pclr->lutdata = jas_malloc2(lutsize, sizeof(int_fast32_t)))) {
 781                 return -1;
 782         }
 783 -       if (!(pclr->bpc = jas_malloc(pclr->numchans * sizeof(uint_fast8_t)))) {
 784 +       if (!(pclr->bpc = jas_malloc2(pclr->numchans, sizeof(uint_fast8_t)))) {
 785                 return -1;
 786         }
 787         for (i = 0; i < pclr->numchans; ++i) {
 788
 789
 790 [FILE:1776:patches/patch-jp2_dec.c]
 791 --- src/libjasper/jp2/jp2_dec.c.orig    2007-01-19 22:43:05.000000000 +0100
 792 +++ src/libjasper/jp2/jp2_dec.c 2016-02-20 13:49:45.565514000 +0100
 793 @@ -291,7 +291,10 @@
 794         case JP2_COLR_ICC:
 795                 iccprof = jas_iccprof_createfrombuf(dec->colr->data.colr.iccp,
 796                   dec->colr->data.colr.iccplen);
 797 -               assert(iccprof);
 798 +               if (!iccprof) {
 799 +                       jas_eprintf("error: failed to parse ICC profile\n");
 800 +                       goto error;
 801 +               }
 802                 jas_iccprof_gethdr(iccprof, &icchdr);
 803                 jas_eprintf("ICC Profile CS %08x\n", icchdr.colorspc);
 804                 jas_image_setclrspc(dec->image, fromiccpcs(icchdr.colorspc));
 805 @@ -336,7 +339,7 @@
 806         }
 807
 808         /* Allocate space for the channel-number to component-number LUT. */
 809 -       if (!(dec->chantocmptlut = jas_malloc(dec->numchans * sizeof(uint_fast16_t)))) {
 810 +       if (!(dec->chantocmptlut = jas_malloc2(dec->numchans, sizeof(uint_fast16_t)))) {
 811                 jas_eprintf("error: no memory\n");
 812                 goto error;
 813         }
 814 @@ -354,7 +357,7 @@
 815                         if (cmapent->map == JP2_CMAP_DIRECT) {
 816                                 dec->chantocmptlut[channo] = channo;
 817                         } else if (cmapent->map == JP2_CMAP_PALETTE) {
 818 -                               lutents = jas_malloc(pclrd->numlutents * sizeof(int_fast32_t));
 819 +                               lutents = jas_malloc2(pclrd->numlutents, sizeof(int_fast32_t));
 820                                 for (i = 0; i < pclrd->numlutents; ++i) {
 821                                         lutents[i] = pclrd->lutdata[cmapent->pcol + i * pclrd->numchans];
 822                                 }
 823 @@ -386,6 +389,11 @@
 824         /* Determine the type of each component. */
 825         if (dec->cdef) {
 826                 for (i = 0; i < dec->numchans; ++i) {
 827 +                       /* Is the channel number reasonable? */
 828 +                       if (dec->cdef->data.cdef.ents[i].channo >= dec->numchans) {
 829 +                               jas_eprintf("error: invalid channel number in CDEF box\n");
 830 +                               goto error;
 831 +                       }
 832                         jas_image_setcmpttype(dec->image,
 833                           dec->chantocmptlut[dec->cdef->data.cdef.ents[i].channo],
 834                           jp2_getct(jas_image_clrspc(dec->image),
 835
 836
 837 [FILE:745:patches/patch-jp2_enc.c]
 838 --- src/libjasper/jp2/jp2_enc.c.orig    2007-01-19 22:43:05.000000000 +0100
 839 +++ src/libjasper/jp2/jp2_enc.c 2016-02-20 13:49:45.569962000 +0100
 840 @@ -191,7 +191,7 @@
 841                 }
 842                 bpcc = &box->data.bpcc;
 843                 bpcc->numcmpts = jas_image_numcmpts(image);
 844 -               if (!(bpcc->bpcs = jas_malloc(bpcc->numcmpts *
 845 +               if (!(bpcc->bpcs = jas_malloc2(bpcc->numcmpts,
 846                   sizeof(uint_fast8_t)))) {
 847                         goto error;
 848                 }
 849 @@ -285,7 +285,7 @@
 850                 }
 851                 cdef = &box->data.cdef;
 852                 cdef->numchans = jas_image_numcmpts(image);
 853 -               cdef->ents = jas_malloc(cdef->numchans * sizeof(jp2_cdefchan_t));
 854 +               cdef->ents = jas_malloc2(cdef->numchans, sizeof(jp2_cdefchan_t));
 855                 for (i = 0; i < jas_image_numcmpts(image); ++i) {
 856                         cdefchanent = &cdef->ents[i];
 857                         cdefchanent->channo = i;
 858
 859
 860 [FILE:3148:patches/patch-jpc_cs.c]
 861 --- src/libjasper/jpc/jpc_cs.c.orig     2007-01-19 22:43:07.000000000 +0100
 862 +++ src/libjasper/jpc/jpc_cs.c  2013-04-17 22:11:18.000000000 +0200
 863 @@ -288,7 +288,7 @@
 864                         jpc_ms_dump(ms, stderr);
 865                 }
 866
 867 -               if (JAS_CAST(ulong, jas_stream_tell(tmpstream)) != ms->len) {
 868 +               if (JAS_CAST(unsigned long, jas_stream_tell(tmpstream)) != ms->len) {
 869                         jas_eprintf("warning: trailing garbage in marker segment (%ld bytes)\n",
 870                           ms->len - jas_stream_tell(tmpstream));
 871                 }
 872 @@ -502,7 +502,7 @@
 873           !siz->tileheight || !siz->numcomps) {
 874                 return -1;
 875         }
 876 -       if (!(siz->comps = jas_malloc(siz->numcomps * sizeof(jpc_sizcomp_t)))) {
 877 +       if (!(siz->comps = jas_malloc2(siz->numcomps, sizeof(jpc_sizcomp_t)))) {
 878                 return -1;
 879         }
 880         for (i = 0; i < siz->numcomps; ++i) {
 881 @@ -744,6 +744,10 @@
 882                 return -1;
 883         }
 884         compparms->numrlvls = compparms->numdlvls + 1;
 885 +       if (compparms->numrlvls > JPC_MAXRLVLS) {
 886 +               jpc_cox_destroycompparms(compparms);
 887 +               return -1;
 888 +       }
 889         if (prtflag) {
 890                 for (i = 0; i < compparms->numrlvls; ++i) {
 891                         if (jpc_getuint8(in, &tmp)) {
 892 @@ -982,8 +986,12 @@
 893                 compparms->numstepsizes = (len - n) / 2;
 894                 break;
 895         }
 896 +       if (compparms->numstepsizes > 3 * JPC_MAXRLVLS + 1) {
 897 +               jpc_qcx_destroycompparms(compparms);
 898 +               return -1;
 899 +       }
 900         if (compparms->numstepsizes > 0) {
 901 -               compparms->stepsizes = jas_malloc(compparms->numstepsizes *
 902 +               compparms->stepsizes = jas_malloc2(compparms->numstepsizes,
 903                   sizeof(uint_fast16_t));
 904                 assert(compparms->stepsizes);
 905                 for (i = 0; i < compparms->numstepsizes; ++i) {
 906 @@ -1091,7 +1099,7 @@
 907
 908         ppm->len = ms->len - 1;
 909         if (ppm->len > 0) {
 910 -               if (!(ppm->data = jas_malloc(ppm->len * sizeof(unsigned char)))) {
 911 +               if (!(ppm->data = jas_malloc2(ppm->len, sizeof(unsigned char)))) {
 912                         goto error;
 913                 }
 914                 if (JAS_CAST(uint, jas_stream_read(in, ppm->data, ppm->len)) != ppm->len) {
 915 @@ -1160,7 +1168,7 @@
 916         }
 917         ppt->len = ms->len - 1;
 918         if (ppt->len > 0) {
 919 -               if (!(ppt->data = jas_malloc(ppt->len * sizeof(unsigned char)))) {
 920 +               if (!(ppt->data = jas_malloc2(ppt->len, sizeof(unsigned char)))) {
 921                         goto error;
 922                 }
 923                 if (jas_stream_read(in, (char *) ppt->data, ppt->len) != JAS_CAST(int, ppt->len)) {
 924 @@ -1223,7 +1231,7 @@
 925         uint_fast8_t tmp;
 926         poc->numpchgs = (cstate->numcomps > 256) ? (ms->len / 9) :
 927           (ms->len / 7);
 928 -       if (!(poc->pchgs = jas_malloc(poc->numpchgs * sizeof(jpc_pocpchg_t)))) {
 929 +       if (!(poc->pchgs = jas_malloc2(poc->numpchgs, sizeof(jpc_pocpchg_t)))) {
 930                 goto error;
 931         }
 932         for (pchgno = 0, pchg = poc->pchgs; pchgno < poc->numpchgs; ++pchgno,
 933 @@ -1328,7 +1336,7 @@
 934         jpc_crgcomp_t *comp;
 935         uint_fast16_t compno;
 936         crg->numcomps = cstate->numcomps;
 937 -       if (!(crg->comps = jas_malloc(cstate->numcomps * sizeof(uint_fast16_t)))) {
 938 +       if (!(crg->comps = jas_malloc2(cstate->numcomps, sizeof(jpc_crgcomp_t)))) {
 939                 return -1;
 940         }
 941         for (compno = 0, comp = crg->comps; compno < cstate->numcomps;
 942 @@ -1467,7 +1475,7 @@
 943         cstate = 0;
 944
 945         if (ms->len > 0) {
 946 -               if (!(unk->data = jas_malloc(ms->len * sizeof(unsigned char)))) {
 947 +               if (!(unk->data = jas_malloc2(ms->len, sizeof(unsigned char)))) {
 948                         return -1;
 949                 }
 950                 if (jas_stream_read(in, (char *) unk->data, ms->len) != JAS_CAST(int, ms->len)) {
 951
 952
 953 [FILE:5372:patches/patch-jpc_dec.c]
 954 --- src/libjasper/jpc/jpc_dec.c.orig    2007-01-19 22:43:07.000000000 +0100
 955 +++ src/libjasper/jpc/jpc_dec.c 2016-02-20 13:49:45.581508000 +0100
 956 @@ -449,7 +449,7 @@
 957
 958         if (dec->state == JPC_MH) {
 959
 960 -               compinfos = jas_malloc(dec->numcomps * sizeof(jas_image_cmptparm_t));
 961 +               compinfos = jas_malloc2(dec->numcomps, sizeof(jas_image_cmptparm_t));
 962                 assert(compinfos);
 963                 for (cmptno = 0, cmpt = dec->cmpts, compinfo = compinfos;
 964                   cmptno < dec->numcomps; ++cmptno, ++cmpt, ++compinfo) {
 965 @@ -489,7 +489,7 @@
 966                 dec->curtileendoff = 0;
 967         }
 968
 969 -       if (JAS_CAST(int, sot->tileno) > dec->numtiles) {
 970 +       if (JAS_CAST(int, sot->tileno) >= dec->numtiles) {
 971                 jas_eprintf("invalid tile number in SOT marker segment\n");
 972                 return -1;
 973         }
 974 @@ -692,7 +692,7 @@
 975                         tile->realmode = 1;
 976                 }
 977                 tcomp->numrlvls = ccp->numrlvls;
 978 -               if (!(tcomp->rlvls = jas_malloc(tcomp->numrlvls *
 979 +               if (!(tcomp->rlvls = jas_malloc2(tcomp->numrlvls,
 980                   sizeof(jpc_dec_rlvl_t)))) {
 981                         return -1;
 982                 }
 983 @@ -764,7 +764,7 @@
 984                           rlvl->cbgheightexpn);
 985
 986                         rlvl->numbands = (!rlvlno) ? 1 : 3;
 987 -                       if (!(rlvl->bands = jas_malloc(rlvl->numbands *
 988 +                       if (!(rlvl->bands = jas_malloc2(rlvl->numbands,
 989                           sizeof(jpc_dec_band_t)))) {
 990                                 return -1;
 991                         }
 992 @@ -797,7 +797,7 @@
 993
 994                                 assert(rlvl->numprcs);
 995
 996 -                               if (!(band->prcs = jas_malloc(rlvl->numprcs * sizeof(jpc_dec_prc_t)))) {
 997 +                               if (!(band->prcs = jas_malloc2(rlvl->numprcs, sizeof(jpc_dec_prc_t)))) {
 998                                         return -1;
 999                                 }
1000
1001 @@ -834,7 +834,7 @@
1002                         if (!(prc->numimsbstagtree = jpc_tagtree_create(prc->numhcblks, prc->numvcblks))) {
1003                                 return -1;
1004                         }
1005 -                       if (!(prc->cblks = jas_malloc(prc->numcblks * sizeof(jpc_dec_cblk_t)))) {
1006 +                       if (!(prc->cblks = jas_malloc2(prc->numcblks, sizeof(jpc_dec_cblk_t)))) {
1007                                 return -1;
1008                         }
1009
1010 @@ -1069,12 +1069,12 @@
1011         /* Apply an inverse intercomponent transform if necessary. */
1012         switch (tile->cp->mctid) {
1013         case JPC_MCT_RCT:
1014 -               assert(dec->numcomps == 3);
1015 +               assert(dec->numcomps == 3 || dec->numcomps == 4);
1016                 jpc_irct(tile->tcomps[0].data, tile->tcomps[1].data,
1017                   tile->tcomps[2].data);
1018                 break;
1019         case JPC_MCT_ICT:
1020 -               assert(dec->numcomps == 3);
1021 +               assert(dec->numcomps == 3 || dec->numcomps == 4);
1022                 jpc_iict(tile->tcomps[0].data, tile->tcomps[1].data,
1023                   tile->tcomps[2].data);
1024                 break;
1025 @@ -1181,7 +1181,7 @@
1026                 return -1;
1027         }
1028
1029 -       if (!(dec->cmpts = jas_malloc(dec->numcomps * sizeof(jpc_dec_cmpt_t)))) {
1030 +       if (!(dec->cmpts = jas_malloc2(dec->numcomps, sizeof(jpc_dec_cmpt_t)))) {
1031                 return -1;
1032         }
1033
1034 @@ -1204,7 +1204,7 @@
1035         dec->numhtiles = JPC_CEILDIV(dec->xend - dec->tilexoff, dec->tilewidth);
1036         dec->numvtiles = JPC_CEILDIV(dec->yend - dec->tileyoff, dec->tileheight);
1037         dec->numtiles = dec->numhtiles * dec->numvtiles;
1038 -       if (!(dec->tiles = jas_malloc(dec->numtiles * sizeof(jpc_dec_tile_t)))) {
1039 +       if (!(dec->tiles = jas_calloc(dec->numtiles, sizeof(jpc_dec_tile_t)))) {
1040                 return -1;
1041         }
1042
1043 @@ -1228,7 +1228,7 @@
1044                 tile->pkthdrstreampos = 0;
1045                 tile->pptstab = 0;
1046                 tile->cp = 0;
1047 -               if (!(tile->tcomps = jas_malloc(dec->numcomps *
1048 +               if (!(tile->tcomps = jas_calloc(dec->numcomps,
1049                   sizeof(jpc_dec_tcomp_t)))) {
1050                         return -1;
1051                 }
1052 @@ -1280,7 +1280,7 @@
1053         jpc_coc_t *coc = &ms->parms.coc;
1054         jpc_dec_tile_t *tile;
1055
1056 -       if (JAS_CAST(int, coc->compno) > dec->numcomps) {
1057 +       if (JAS_CAST(int, coc->compno) >= dec->numcomps) {
1058                 jas_eprintf("invalid component number in COC marker segment\n");
1059                 return -1;
1060         }
1061 @@ -1306,7 +1306,7 @@
1062         jpc_rgn_t *rgn = &ms->parms.rgn;
1063         jpc_dec_tile_t *tile;
1064
1065 -       if (JAS_CAST(int, rgn->compno) > dec->numcomps) {
1066 +       if (JAS_CAST(int, rgn->compno) >= dec->numcomps) {
1067                 jas_eprintf("invalid component number in RGN marker segment\n");
1068                 return -1;
1069         }
1070 @@ -1355,7 +1355,7 @@
1071         jpc_qcc_t *qcc = &ms->parms.qcc;
1072         jpc_dec_tile_t *tile;
1073
1074 -       if (JAS_CAST(int, qcc->compno) > dec->numcomps) {
1075 +       if (JAS_CAST(int, qcc->compno) >= dec->numcomps) {
1076                 jas_eprintf("invalid component number in QCC marker segment\n");
1077                 return -1;
1078         }
1079 @@ -1489,7 +1489,7 @@
1080         cp->numlyrs = 0;
1081         cp->mctid = 0;
1082         cp->csty = 0;
1083 -       if (!(cp->ccps = jas_malloc(cp->numcomps * sizeof(jpc_dec_ccp_t)))) {
1084 +       if (!(cp->ccps = jas_malloc2(cp->numcomps, sizeof(jpc_dec_ccp_t)))) {
1085                 return 0;
1086         }
1087         if (!(cp->pchglist = jpc_pchglist_create())) {
1088 @@ -2048,7 +2048,7 @@
1089         }
1090         streamlist->numstreams = 0;
1091         streamlist->maxstreams = 100;
1092 -       if (!(streamlist->streams = jas_malloc(streamlist->maxstreams *
1093 +       if (!(streamlist->streams = jas_malloc2(streamlist->maxstreams,
1094           sizeof(jas_stream_t *)))) {
1095                 jas_free(streamlist);
1096                 return 0;
1097 @@ -2068,8 +2068,8 @@
1098         /* Grow the array of streams if necessary. */
1099         if (streamlist->numstreams >= streamlist->maxstreams) {
1100                 newmaxstreams = streamlist->maxstreams + 1024;
1101 -               if (!(newstreams = jas_realloc(streamlist->streams,
1102 -                 (newmaxstreams + 1024) * sizeof(jas_stream_t *)))) {
1103 +               if (!(newstreams = jas_realloc2(streamlist->streams,
1104 +                 (newmaxstreams + 1024), sizeof(jas_stream_t *)))) {
1105                         return -1;
1106                 }
1107                 for (i = streamlist->numstreams; i < streamlist->maxstreams; ++i) {
1108 @@ -2155,8 +2155,8 @@
1109  {
1110         jpc_ppxstabent_t **newents;
1111         if (tab->maxents < maxents) {
1112 -               newents = (tab->ents) ? jas_realloc(tab->ents, maxents *
1113 -                 sizeof(jpc_ppxstabent_t *)) : jas_malloc(maxents * sizeof(jpc_ppxstabent_t *));
1114 +               newents = jas_realloc2(tab->ents, maxents,
1115 +                 sizeof(jpc_ppxstabent_t *));
1116                 if (!newents) {
1117                         return -1;
1118                 }
1119
1120
1121 [FILE:3361:patches/patch-jpc_enc.c]
1122 --- src/libjasper/jpc/jpc_enc.c.orig    2007-01-19 22:43:07.000000000 +0100
1123 +++ src/libjasper/jpc/jpc_enc.c 2013-04-17 22:32:23.000000000 +0200
1124 @@ -403,7 +403,7 @@
1125                 vsteplcm *= jas_image_cmptvstep(image, cmptno);
1126         }
1127
1128 -       if (!(cp->ccps = jas_malloc(cp->numcmpts * sizeof(jpc_enc_ccp_t)))) {
1129 +       if (!(cp->ccps = jas_malloc2(cp->numcmpts, sizeof(jpc_enc_ccp_t)))) {
1130                 goto error;
1131         }
1132         for (cmptno = 0, ccp = cp->ccps; cmptno < JAS_CAST(int, cp->numcmpts); ++cmptno,
1133 @@ -656,7 +656,7 @@
1134
1135         if (ilyrrates && numilyrrates > 0) {
1136                 tcp->numlyrs = numilyrrates + 1;
1137 -               if (!(tcp->ilyrrates = jas_malloc((tcp->numlyrs - 1) *
1138 +               if (!(tcp->ilyrrates = jas_malloc2((tcp->numlyrs - 1),
1139                   sizeof(jpc_fix_t)))) {
1140                         goto error;
1141                 }
1142 @@ -940,7 +940,7 @@
1143         siz->tilewidth = cp->tilewidth;
1144         siz->tileheight = cp->tileheight;
1145         siz->numcomps = cp->numcmpts;
1146 -       siz->comps = jas_malloc(siz->numcomps * sizeof(jpc_sizcomp_t));
1147 +       siz->comps = jas_malloc2(siz->numcomps, sizeof(jpc_sizcomp_t));
1148         assert(siz->comps);
1149         for (i = 0; i < JAS_CAST(int, cp->numcmpts); ++i) {
1150                 siz->comps[i].prec = cp->ccps[i].prec;
1151 @@ -977,7 +977,7 @@
1152                 return -1;
1153         }
1154         crg = &enc->mrk->parms.crg;
1155 -       crg->comps = jas_malloc(crg->numcomps * sizeof(jpc_crgcomp_t));
1156 +       crg->comps = jas_malloc2(crg->numcomps, sizeof(jpc_crgcomp_t));
1157         if (jpc_putms(enc->out, enc->cstate, enc->mrk)) {
1158                 jas_eprintf("cannot write CRG marker\n");
1159                 return -1;
1160 @@ -1955,7 +1955,7 @@
1161         tile->mctid = cp->tcp.mctid;
1162
1163         tile->numlyrs = cp->tcp.numlyrs;
1164 -       if (!(tile->lyrsizes = jas_malloc(tile->numlyrs *
1165 +       if (!(tile->lyrsizes = jas_malloc2(tile->numlyrs,
1166           sizeof(uint_fast32_t)))) {
1167                 goto error;
1168         }
1169 @@ -1964,7 +1964,7 @@
1170         }
1171
1172         /* Allocate an array for the per-tile-component information. */
1173 -       if (!(tile->tcmpts = jas_malloc(cp->numcmpts * sizeof(jpc_enc_tcmpt_t)))) {
1174 +       if (!(tile->tcmpts = jas_malloc2(cp->numcmpts, sizeof(jpc_enc_tcmpt_t)))) {
1175                 goto error;
1176         }
1177         /* Initialize a few members critical for error recovery. */
1178 @@ -2110,7 +2110,7 @@
1179           jas_seq2d_ystart(tcmpt->data), jas_seq2d_xend(tcmpt->data),
1180           jas_seq2d_yend(tcmpt->data), bandinfos);
1181
1182 -       if (!(tcmpt->rlvls = jas_malloc(tcmpt->numrlvls * sizeof(jpc_enc_rlvl_t)))) {
1183 +       if (!(tcmpt->rlvls = jas_malloc2(tcmpt->numrlvls, sizeof(jpc_enc_rlvl_t)))) {
1184                 goto error;
1185         }
1186         for (rlvlno = 0, rlvl = tcmpt->rlvls; rlvlno < tcmpt->numrlvls;
1187 @@ -2213,7 +2213,7 @@
1188         rlvl->numvprcs = JPC_FLOORDIVPOW2(brprcbry - tlprctly, rlvl->prcheightexpn);
1189         rlvl->numprcs = rlvl->numhprcs * rlvl->numvprcs;
1190
1191 -       if (!(rlvl->bands = jas_malloc(rlvl->numbands * sizeof(jpc_enc_band_t)))) {
1192 +       if (!(rlvl->bands = jas_malloc2(rlvl->numbands, sizeof(jpc_enc_band_t)))) {
1193                 goto error;
1194         }
1195         for (bandno = 0, band = rlvl->bands; bandno < rlvl->numbands;
1196 @@ -2290,7 +2290,7 @@
1197         band->synweight = bandinfo->synenergywt;
1198
1199  if (band->data) {
1200 -       if (!(band->prcs = jas_malloc(rlvl->numprcs * sizeof(jpc_enc_prc_t)))) {
1201 +       if (!(band->prcs = jas_malloc2(rlvl->numprcs, sizeof(jpc_enc_prc_t)))) {
1202                 goto error;
1203         }
1204         for (prcno = 0, prc = band->prcs; prcno < rlvl->numprcs; ++prcno,
1205 @@ -2422,7 +2422,7 @@
1206                         goto error;
1207                 }
1208
1209 -               if (!(prc->cblks = jas_malloc(prc->numcblks * sizeof(jpc_enc_cblk_t)))) {
1210 +               if (!(prc->cblks = jas_malloc2(prc->numcblks, sizeof(jpc_enc_cblk_t)))) {
1211                         goto error;
1212                 }
1213                 for (cblkno = 0, cblk = prc->cblks; cblkno < prc->numcblks;
1214
1215
1216 [FILE:505:patches/patch-jpc_mqdec.c]
1217 --- src/libjasper/jpc/jpc_mqdec.c.orig  2007-01-19 22:43:07.000000000 +0100
1218 +++ src/libjasper/jpc/jpc_mqdec.c       2013-04-17 22:32:23.000000000 +0200
1219 @@ -118,7 +118,7 @@
1220         mqdec->in = in;
1221         mqdec->maxctxs = maxctxs;
1222         /* Allocate memory for the per-context state information. */
1223 -       if (!(mqdec->ctxs = jas_malloc(mqdec->maxctxs * sizeof(jpc_mqstate_t *)))) {
1224 +       if (!(mqdec->ctxs = jas_malloc2(mqdec->maxctxs, sizeof(jpc_mqstate_t *)))) {
1225                 goto error;
1226         }
1227         /* Set the current context to the first context. */
1228
1229
1230 [FILE:437:patches/patch-jpc_mqenc.c]
1231 --- src/libjasper/jpc/jpc_mqenc.c.orig  2007-01-19 22:43:07.000000000 +0100
1232 +++ src/libjasper/jpc/jpc_mqenc.c       2013-04-17 22:32:23.000000000 +0200
1233 @@ -197,7 +197,7 @@
1234         mqenc->maxctxs = maxctxs;
1235
1236         /* Allocate memory for the per-context state information. */
1237 -       if (!(mqenc->ctxs = jas_malloc(mqenc->maxctxs * sizeof(jpc_mqstate_t *)))) {
1238 +       if (!(mqenc->ctxs = jas_malloc2(mqenc->maxctxs, sizeof(jpc_mqstate_t *)))) {
1239                 goto error;
1240         }
1241
1242
1243
1244 [FILE:7955:patches/patch-jpc_qmfb.c]
1245 --- src/libjasper/jpc/jpc_qmfb.c.orig   2007-01-19 22:43:07.000000000 +0100
1246 +++ src/libjasper/jpc/jpc_qmfb.c        2016-02-20 13:56:19.711609000 +0100
1247 @@ -305,12 +305,8 @@
1248  void jpc_qmfb_split_row(jpc_fix_t *a, int numcols, int parity)
1249  {
1250
1251 -       int bufsize = JPC_CEILDIVPOW2(numcols, 1);
1252 -#if !defined(HAVE_VLA)
1253 +       size_t bufsize = JPC_CEILDIVPOW2(numcols, 1);
1254         jpc_fix_t splitbuf[QMFB_SPLITBUFSIZE];
1255 -#else
1256 -       jpc_fix_t splitbuf[bufsize];
1257 -#endif
1258         jpc_fix_t *buf = splitbuf;
1259         register jpc_fix_t *srcptr;
1260         register jpc_fix_t *dstptr;
1261 @@ -318,15 +314,13 @@
1262         register int m;
1263         int hstartcol;
1264
1265 -#if !defined(HAVE_VLA)
1266         /* Get a buffer. */
1267         if (bufsize > QMFB_SPLITBUFSIZE) {
1268 -               if (!(buf = jas_malloc(bufsize * sizeof(jpc_fix_t)))) {
1269 +               if (!(buf = jas_malloc2(bufsize, sizeof(jpc_fix_t)))) {
1270                         /* We have no choice but to commit suicide in this case. */
1271                         abort();
1272                 }
1273         }
1274 -#endif
1275
1276         if (numcols >= 2) {
1277                 hstartcol = (numcols + 1 - parity) >> 1;
1278 @@ -360,12 +354,10 @@
1279                 }
1280         }
1281
1282 -#if !defined(HAVE_VLA)
1283         /* If the split buffer was allocated on the heap, free this memory. */
1284         if (buf != splitbuf) {
1285                 jas_free(buf);
1286         }
1287 -#endif
1288
1289  }
1290
1291 @@ -373,12 +365,8 @@
1292    int parity)
1293  {
1294
1295 -       int bufsize = JPC_CEILDIVPOW2(numrows, 1);
1296 -#if !defined(HAVE_VLA)
1297 +       size_t bufsize = JPC_CEILDIVPOW2(numrows, 1);
1298         jpc_fix_t splitbuf[QMFB_SPLITBUFSIZE];
1299 -#else
1300 -       jpc_fix_t splitbuf[bufsize];
1301 -#endif
1302         jpc_fix_t *buf = splitbuf;
1303         register jpc_fix_t *srcptr;
1304         register jpc_fix_t *dstptr;
1305 @@ -386,15 +374,13 @@
1306         register int m;
1307         int hstartcol;
1308
1309 -#if !defined(HAVE_VLA)
1310         /* Get a buffer. */
1311         if (bufsize > QMFB_SPLITBUFSIZE) {
1312 -               if (!(buf = jas_malloc(bufsize * sizeof(jpc_fix_t)))) {
1313 +               if (!(buf = jas_malloc2(bufsize, sizeof(jpc_fix_t)))) {
1314                         /* We have no choice but to commit suicide in this case. */
1315                         abort();
1316                 }
1317         }
1318 -#endif
1319
1320         if (numrows >= 2) {
1321                 hstartcol = (numrows + 1 - parity) >> 1;
1322 @@ -428,12 +414,10 @@
1323                 }
1324         }
1325
1326 -#if !defined(HAVE_VLA)
1327         /* If the split buffer was allocated on the heap, free this memory. */
1328         if (buf != splitbuf) {
1329                 jas_free(buf);
1330         }
1331 -#endif
1332
1333  }
1334
1335 @@ -441,12 +425,8 @@
1336    int parity)
1337  {
1338
1339 -       int bufsize = JPC_CEILDIVPOW2(numrows, 1);
1340 -#if !defined(HAVE_VLA)
1341 +       size_t bufsize = JPC_CEILDIVPOW2(numrows, 1);
1342         jpc_fix_t splitbuf[QMFB_SPLITBUFSIZE * JPC_QMFB_COLGRPSIZE];
1343 -#else
1344 -       jpc_fix_t splitbuf[bufsize * JPC_QMFB_COLGRPSIZE];
1345 -#endif
1346         jpc_fix_t *buf = splitbuf;
1347         jpc_fix_t *srcptr;
1348         jpc_fix_t *dstptr;
1349 @@ -457,15 +437,13 @@
1350         int m;
1351         int hstartcol;
1352
1353 -#if !defined(HAVE_VLA)
1354         /* Get a buffer. */
1355         if (bufsize > QMFB_SPLITBUFSIZE) {
1356 -               if (!(buf = jas_malloc(bufsize * sizeof(jpc_fix_t)))) {
1357 +               if (!(buf = jas_malloc2(bufsize, sizeof(jpc_fix_t)))) {
1358                         /* We have no choice but to commit suicide in this case. */
1359                         abort();
1360                 }
1361         }
1362 -#endif
1363
1364         if (numrows >= 2) {
1365                 hstartcol = (numrows + 1 - parity) >> 1;
1366 @@ -517,12 +495,10 @@
1367                 }
1368         }
1369
1370 -#if !defined(HAVE_VLA)
1371         /* If the split buffer was allocated on the heap, free this memory. */
1372         if (buf != splitbuf) {
1373                 jas_free(buf);
1374         }
1375 -#endif
1376
1377  }
1378
1379 @@ -530,12 +506,8 @@
1380    int stride, int parity)
1381  {
1382
1383 -       int bufsize = JPC_CEILDIVPOW2(numrows, 1);
1384 -#if !defined(HAVE_VLA)
1385 +       size_t bufsize = JPC_CEILDIVPOW2(numrows, 1);
1386         jpc_fix_t splitbuf[QMFB_SPLITBUFSIZE * JPC_QMFB_COLGRPSIZE];
1387 -#else
1388 -       jpc_fix_t splitbuf[bufsize * numcols];
1389 -#endif
1390         jpc_fix_t *buf = splitbuf;
1391         jpc_fix_t *srcptr;
1392         jpc_fix_t *dstptr;
1393 @@ -546,15 +518,13 @@
1394         int m;
1395         int hstartcol;
1396
1397 -#if !defined(HAVE_VLA)
1398         /* Get a buffer. */
1399         if (bufsize > QMFB_SPLITBUFSIZE) {
1400 -               if (!(buf = jas_malloc(bufsize * sizeof(jpc_fix_t)))) {
1401 +               if (!(buf = jas_malloc2(bufsize, sizeof(jpc_fix_t)))) {
1402                         /* We have no choice but to commit suicide in this case. */
1403                         abort();
1404                 }
1405         }
1406 -#endif
1407
1408         if (numrows >= 2) {
1409                 hstartcol = (numrows + 1 - parity) >> 1;
1410 @@ -606,39 +576,31 @@
1411                 }
1412         }
1413
1414 -#if !defined(HAVE_VLA)
1415         /* If the split buffer was allocated on the heap, free this memory. */
1416         if (buf != splitbuf) {
1417                 jas_free(buf);
1418         }
1419 -#endif
1420
1421  }
1422
1423  void jpc_qmfb_join_row(jpc_fix_t *a, int numcols, int parity)
1424  {
1425
1426 -       int bufsize = JPC_CEILDIVPOW2(numcols, 1);
1427 -#if !defined(HAVE_VLA)
1428 +       size_t bufsize = JPC_CEILDIVPOW2(numcols, 1);
1429         jpc_fix_t joinbuf[QMFB_JOINBUFSIZE];
1430 -#else
1431 -       jpc_fix_t joinbuf[bufsize];
1432 -#endif
1433         jpc_fix_t *buf = joinbuf;
1434         register jpc_fix_t *srcptr;
1435         register jpc_fix_t *dstptr;
1436         register int n;
1437         int hstartcol;
1438
1439 -#if !defined(HAVE_VLA)
1440         /* Allocate memory for the join buffer from the heap. */
1441         if (bufsize > QMFB_JOINBUFSIZE) {
1442 -               if (!(buf = jas_malloc(bufsize * sizeof(jpc_fix_t)))) {
1443 +               if (!(buf = jas_malloc2(bufsize, sizeof(jpc_fix_t)))) {
1444                         /* We have no choice but to commit suicide. */
1445                         abort();
1446                 }
1447         }
1448 -#endif
1449
1450         hstartcol = (numcols + 1 - parity) >> 1;
1451
1452 @@ -670,12 +632,10 @@
1453                 ++srcptr;
1454         }
1455
1456 -#if !defined(HAVE_VLA)
1457         /* If the join buffer was allocated on the heap, free this memory. */
1458         if (buf != joinbuf) {
1459                 jas_free(buf);
1460         }
1461 -#endif
1462
1463  }
1464
1465 @@ -683,27 +643,21 @@
1466    int parity)
1467  {
1468
1469 -       int bufsize = JPC_CEILDIVPOW2(numrows, 1);
1470 -#if !defined(HAVE_VLA)
1471 +       size_t bufsize = JPC_CEILDIVPOW2(numrows, 1);
1472         jpc_fix_t joinbuf[QMFB_JOINBUFSIZE];
1473 -#else
1474 -       jpc_fix_t joinbuf[bufsize];
1475 -#endif
1476         jpc_fix_t *buf = joinbuf;
1477         register jpc_fix_t *srcptr;
1478         register jpc_fix_t *dstptr;
1479         register int n;
1480         int hstartcol;
1481
1482 -#if !defined(HAVE_VLA)
1483         /* Allocate memory for the join buffer from the heap. */
1484         if (bufsize > QMFB_JOINBUFSIZE) {
1485 -               if (!(buf = jas_malloc(bufsize * sizeof(jpc_fix_t)))) {
1486 +               if (!(buf = jas_malloc2(bufsize, sizeof(jpc_fix_t)))) {
1487                         /* We have no choice but to commit suicide. */
1488                         abort();
1489                 }
1490         }
1491 -#endif
1492
1493         hstartcol = (numrows + 1 - parity) >> 1;
1494
1495 @@ -735,12 +689,10 @@
1496                 ++srcptr;
1497         }
1498
1499 -#if !defined(HAVE_VLA)
1500         /* If the join buffer was allocated on the heap, free this memory. */
1501         if (buf != joinbuf) {
1502                 jas_free(buf);
1503         }
1504 -#endif
1505
1506  }
1507
1508 @@ -748,12 +700,8 @@
1509    int parity)
1510  {
1511
1512 -       int bufsize = JPC_CEILDIVPOW2(numrows, 1);
1513 -#if !defined(HAVE_VLA)
1514 +       size_t bufsize = JPC_CEILDIVPOW2(numrows, 1);
1515         jpc_fix_t joinbuf[QMFB_JOINBUFSIZE * JPC_QMFB_COLGRPSIZE];
1516 -#else
1517 -       jpc_fix_t joinbuf[bufsize * JPC_QMFB_COLGRPSIZE];
1518 -#endif
1519         jpc_fix_t *buf = joinbuf;
1520         jpc_fix_t *srcptr;
1521         jpc_fix_t *dstptr;
1522 @@ -763,15 +711,13 @@
1523         register int i;
1524         int hstartcol;
1525
1526 -#if !defined(HAVE_VLA)
1527         /* Allocate memory for the join buffer from the heap. */
1528         if (bufsize > QMFB_JOINBUFSIZE) {
1529 -               if (!(buf = jas_malloc(bufsize * JPC_QMFB_COLGRPSIZE * sizeof(jpc_fix_t)))) {
1530 +               if (!(buf = jas_malloc2(bufsize, JPC_QMFB_COLGRPSIZE * sizeof(jpc_fix_t)))) {
1531                         /* We have no choice but to commit suicide. */
1532                         abort();
1533                 }
1534         }
1535 -#endif
1536
1537         hstartcol = (numrows + 1 - parity) >> 1;
1538
1539 @@ -821,12 +767,10 @@
1540                 srcptr += JPC_QMFB_COLGRPSIZE;
1541         }
1542
1543 -#if !defined(HAVE_VLA)
1544         /* If the join buffer was allocated on the heap, free this memory. */
1545         if (buf != joinbuf) {
1546                 jas_free(buf);
1547         }
1548 -#endif
1549
1550  }
1551
1552 @@ -834,12 +778,8 @@
1553    int stride, int parity)
1554  {
1555
1556 -       int bufsize = JPC_CEILDIVPOW2(numrows, 1);
1557 -#if !defined(HAVE_VLA)
1558 +       size_t bufsize = JPC_CEILDIVPOW2(numrows, 1);
1559         jpc_fix_t joinbuf[QMFB_JOINBUFSIZE * JPC_QMFB_COLGRPSIZE];
1560 -#else
1561 -       jpc_fix_t joinbuf[bufsize * numcols];
1562 -#endif
1563         jpc_fix_t *buf = joinbuf;
1564         jpc_fix_t *srcptr;
1565         jpc_fix_t *dstptr;
1566 @@ -849,15 +789,13 @@
1567         register int i;
1568         int hstartcol;
1569
1570 -#if !defined(HAVE_VLA)
1571         /* Allocate memory for the join buffer from the heap. */
1572         if (bufsize > QMFB_JOINBUFSIZE) {
1573 -               if (!(buf = jas_malloc(bufsize * numcols * sizeof(jpc_fix_t)))) {
1574 +               if (!(buf = jas_malloc3(bufsize, numcols, sizeof(jpc_fix_t)))) {
1575                         /* We have no choice but to commit suicide. */
1576                         abort();
1577                 }
1578         }
1579 -#endif
1580
1581         hstartcol = (numrows + 1 - parity) >> 1;
1582
1583 @@ -907,12 +845,10 @@
1584                 srcptr += numcols;
1585         }
1586
1587 -#if !defined(HAVE_VLA)
1588         /* If the join buffer was allocated on the heap, free this memory. */
1589         if (buf != joinbuf) {
1590                 jas_free(buf);
1591         }
1592 -#endif
1593
1594  }
1595
1596
1597
1598 [FILE:466:patches/patch-jpc_t1enc.c]
1599 --- src/libjasper/jpc/jpc_t1enc.c.orig  2007-01-19 22:43:07.000000000 +0100
1600 +++ src/libjasper/jpc/jpc_t1enc.c       2013-04-17 22:32:23.000000000 +0200
1601 @@ -219,7 +219,7 @@
1602
1603         cblk->numpasses = (cblk->numbps > 0) ? (3 * cblk->numbps - 2) : 0;
1604         if (cblk->numpasses > 0) {
1605 -               cblk->passes = jas_malloc(cblk->numpasses * sizeof(jpc_enc_pass_t));
1606 +               cblk->passes = jas_malloc2(cblk->numpasses, sizeof(jpc_enc_pass_t));
1607                 assert(cblk->passes);
1608         } else {
1609                 cblk->passes = 0;
1610
1611
1612 [FILE:497:patches/patch-jpc_t2cod.c]
1613 --- src/libjasper/jpc/jpc_t2cod.c.orig  2007-01-19 22:43:07.000000000 +0100
1614 +++ src/libjasper/jpc/jpc_t2cod.c       2013-04-17 22:32:23.000000000 +0200
1615 @@ -573,7 +573,7 @@
1616         }
1617         if (pchglist->numpchgs >= pchglist->maxpchgs) {
1618                 newmaxpchgs = pchglist->maxpchgs + 128;
1619 -               if (!(newpchgs = jas_realloc(pchglist->pchgs, newmaxpchgs * sizeof(jpc_pchg_t *)))) {
1620 +               if (!(newpchgs = jas_realloc2(pchglist->pchgs, newmaxpchgs, sizeof(jpc_pchg_t *)))) {
1621                         return -1;
1622                 }
1623                 pchglist->maxpchgs = newmaxpchgs;
1624
1625
1626 [FILE:1122:patches/patch-jpc_t2dec.c]
1627 --- src/libjasper/jpc/jpc_t2dec.c.orig  2007-01-19 22:43:07.000000000 +0100
1628 +++ src/libjasper/jpc/jpc_t2dec.c       2013-04-17 22:32:23.000000000 +0200
1629 @@ -478,7 +478,7 @@
1630                 return 0;
1631         }
1632         pi->numcomps = dec->numcomps;
1633 -       if (!(pi->picomps = jas_malloc(pi->numcomps * sizeof(jpc_picomp_t)))) {
1634 +       if (!(pi->picomps = jas_malloc2(pi->numcomps, sizeof(jpc_picomp_t)))) {
1635                 jpc_pi_destroy(pi);
1636                 return 0;
1637         }
1638 @@ -490,7 +490,7 @@
1639         for (compno = 0, tcomp = tile->tcomps, picomp = pi->picomps;
1640           compno < pi->numcomps; ++compno, ++tcomp, ++picomp) {
1641                 picomp->numrlvls = tcomp->numrlvls;
1642 -               if (!(picomp->pirlvls = jas_malloc(picomp->numrlvls *
1643 +               if (!(picomp->pirlvls = jas_malloc2(picomp->numrlvls,
1644                   sizeof(jpc_pirlvl_t)))) {
1645                         jpc_pi_destroy(pi);
1646                         return 0;
1647 @@ -503,7 +503,7 @@
1648                   rlvlno < picomp->numrlvls; ++rlvlno, ++pirlvl, ++rlvl) {
1649  /* XXX sizeof(long) should be sizeof different type */
1650                         pirlvl->numprcs = rlvl->numprcs;
1651 -                       if (!(pirlvl->prclyrnos = jas_malloc(pirlvl->numprcs *
1652 +                       if (!(pirlvl->prclyrnos = jas_malloc2(pirlvl->numprcs,
1653                           sizeof(long)))) {
1654                                 jpc_pi_destroy(pi);
1655                                 return 0;
1656
1657
1658 [FILE:1094:patches/patch-jpc_t2enc.c]
1659 --- src/libjasper/jpc/jpc_t2enc.c.orig  2007-01-19 22:43:07.000000000 +0100
1660 +++ src/libjasper/jpc/jpc_t2enc.c       2013-04-17 22:32:23.000000000 +0200
1661 @@ -565,7 +565,7 @@
1662         }
1663         pi->pktno = -1;
1664         pi->numcomps = cp->numcmpts;
1665 -       if (!(pi->picomps = jas_malloc(pi->numcomps * sizeof(jpc_picomp_t)))) {
1666 +       if (!(pi->picomps = jas_malloc2(pi->numcomps, sizeof(jpc_picomp_t)))) {
1667                 jpc_pi_destroy(pi);
1668                 return 0;
1669         }
1670 @@ -577,7 +577,7 @@
1671         for (compno = 0, tcomp = tile->tcmpts, picomp = pi->picomps;
1672           compno < pi->numcomps; ++compno, ++tcomp, ++picomp) {
1673                 picomp->numrlvls = tcomp->numrlvls;
1674 -               if (!(picomp->pirlvls = jas_malloc(picomp->numrlvls *
1675 +               if (!(picomp->pirlvls = jas_malloc2(picomp->numrlvls,
1676                   sizeof(jpc_pirlvl_t)))) {
1677                         jpc_pi_destroy(pi);
1678                         return 0;
1679 @@ -591,7 +591,7 @@
1680  /* XXX sizeof(long) should be sizeof different type */
1681                         pirlvl->numprcs = rlvl->numprcs;
1682                         if (rlvl->numprcs) {
1683 -                               if (!(pirlvl->prclyrnos = jas_malloc(pirlvl->numprcs *
1684 +                               if (!(pirlvl->prclyrnos = jas_malloc2(pirlvl->numprcs,
1685                                   sizeof(long)))) {
1686                                         jpc_pi_destroy(pi);
1687                                         return 0;
1688
1689
1690 [FILE:389:patches/patch-jpc_tagtree.c]
1691 --- src/libjasper/jpc/jpc_tagtree.c.orig        2007-01-19 22:43:07.000000000 +0100
1692 +++ src/libjasper/jpc/jpc_tagtree.c     2013-04-17 22:32:23.000000000 +0200
1693 @@ -125,7 +125,7 @@
1694                 ++numlvls;
1695         } while (n > 1);
1696
1697 -       if (!(tree->nodes_ = jas_malloc(tree->numnodes_ * sizeof(jpc_tagtreenode_t)))) {
1698 +       if (!(tree->nodes_ = jas_malloc2(tree->numnodes_, sizeof(jpc_tagtreenode_t)))) {
1699                 return 0;
1700         }
1701
1702
1703
1704 [FILE:300:patches/patch-jpc_util.c]
1705 --- src/libjasper/jpc/jpc_util.c.orig   2007-01-19 22:43:07.000000000 +0100
1706 +++ src/libjasper/jpc/jpc_util.c        2013-04-17 22:32:23.000000000 +0200
1707 @@ -109,7 +109,7 @@
1708         }
1709
1710         if (n) {
1711 -               if (!(vs = jas_malloc(n * sizeof(double)))) {
1712 +               if (!(vs = jas_malloc2(n, sizeof(double)))) {
1713                         return -1;
1714                 }
1715
1716
1717
1718 [FILE:290:patches/patch-libjasper-Makefile.in]
1719 --- src/libjasper/Makefile.in.orig      Wed Feb  7 11:18:06 2007
1720 +++ src/libjasper/Makefile.in   Wed Feb  7 11:18:28 2007
1721 @@ -290,7 +290,7 @@
1722
1723  # -release $(LT_RELEASE)
1724  libjasper_la_LDFLAGS = \
1725 -       -version-info $(LT_CURRENT):$(LT_REVISION):$(LT_AGE)
1726 +       -version-info 4:0:0
1727
1728  all: all-recursive
1729
1730
1731
1732 [FILE:1394:patches/patch-mif_cod.c]
1733 --- src/libjasper/mif/mif_cod.c.orig    2007-01-19 22:43:05.000000000 +0100
1734 +++ src/libjasper/mif/mif_cod.c 2016-02-20 14:19:34.799575000 +0100
1735 @@ -107,7 +107,7 @@
1736  static int mif_hdr_addcmpt(mif_hdr_t *hdr, int cmptno, mif_cmpt_t *cmpt);
1737  static mif_cmpt_t *mif_cmpt_create(void);
1738  static void mif_cmpt_destroy(mif_cmpt_t *cmpt);
1739 -static char *mif_getline(jas_stream_t *jas_stream, char *buf, int bufsize);
1740 +static char *mif_getline(jas_stream_t *jas_stream, char *buf, size_t bufsize);
1741  static int mif_getc(jas_stream_t *in);
1742  static mif_hdr_t *mif_makehdrfromimage(jas_image_t *image);
1743
1744 @@ -438,8 +438,7 @@
1745         int cmptno;
1746         mif_cmpt_t **newcmpts;
1747         assert(maxcmpts >= hdr->numcmpts);
1748 -       newcmpts = (!hdr->cmpts) ? jas_malloc(maxcmpts * sizeof(mif_cmpt_t *)) :
1749 -         jas_realloc(hdr->cmpts, maxcmpts * sizeof(mif_cmpt_t *));
1750 +       newcmpts = jas_realloc2(hdr->cmpts, maxcmpts, sizeof(mif_cmpt_t *));
1751         if (!newcmpts) {
1752                 return -1;
1753         }
1754 @@ -571,6 +570,8 @@
1755                 }
1756         }
1757         jas_tvparser_destroy(tvp);
1758 +       /* fix for CVE-2015-5221 */
1759 +       tvp = NULL;
1760         if (!cmpt->sampperx || !cmpt->samppery) {
1761                 goto error;
1762         }
1763 @@ -658,7 +659,7 @@
1764  * MIF parsing code.
1765  \******************************************************************************/
1766
1767 -static char *mif_getline(jas_stream_t *stream, char *buf, int bufsize)
1768 +static char *mif_getline(jas_stream_t *stream, char *buf, size_t bufsize)
1769  {
1770         int c;
1771         char *bufptr;
1772
1773
1774 [FILE:5495:patches/patch-uuid-support]
1775 #
1776 # Jasper with uuid patch, required by GDAL, can be downloaded from:
1777 # - http://download.osgeo.org/gdal/
1778 # - http://www.gdal.org/dl/
1779 # - ftp://ftp.remotesensing.org/gdal/
1780 #
1781 # Current version is jasper-1.900.1.uuid.tar.gz.
1782 #
1783 diff -ruN src/libjasper/jp2/jp2_cod.c.orig src/libjasper/jp2/jp2_cod.c
1784 --- src/libjasper/jp2/jp2_cod.c.orig    2007-01-20 05:43:05.000000000 +0800
1785 +++ src/libjasper/jp2/jp2_cod.c 2007-03-06 21:49:58.000000000 +0800
1786 @@ -5,6 +5,11 @@
1787   * All rights reserved.
1788   */
1789
1790 +/*
1791 + * Modified by Andrey Kiselev <dron@ak4719.spb.edu> to properly handle UUID
1792 + * box.
1793 + */
1794 +
1795  /* __START_OF_JASPER_LICENSE__
1796   *
1797   * JasPer License Version 2.0
1798 @@ -127,6 +132,9 @@
1799  static int jp2_pclr_getdata(jp2_box_t *box, jas_stream_t *in);
1800  static int jp2_pclr_putdata(jp2_box_t *box, jas_stream_t *out);
1801  static void jp2_pclr_dumpdata(jp2_box_t *box, FILE *out);
1802 +static void jp2_uuid_destroy(jp2_box_t *box);
1803 +static int jp2_uuid_getdata(jp2_box_t *box, jas_stream_t *in);
1804 +static int jp2_uuid_putdata(jp2_box_t *box, jas_stream_t *out);
1805
1806  /******************************************************************************\
1807  * Local data.
1808 @@ -164,7 +172,7 @@
1809         {JP2_BOX_XML, "XML", 0,
1810           {0, 0, 0, 0, 0}},
1811         {JP2_BOX_UUID, "UUID", 0,
1812 -         {0, 0, 0, 0, 0}},
1813 +         {0, jp2_uuid_destroy, jp2_uuid_getdata, jp2_uuid_putdata, 0}},
1814         {JP2_BOX_UINF, "UINF", JP2_BOX_SUPER,
1815           {0, 0, 0, 0, 0}},
1816         {JP2_BOX_ULST, "ULST", 0,
1817 @@ -271,7 +279,7 @@
1818         } else {
1819                 box->datalen = box->len - JP2_BOX_HDRLEN(false);
1820         }
1821 -       if (box->len != 0 && box->len < 8) {
1822 +       if (box->len != 0 && box->len < JP2_BOX_HDRLEN(false)) {
1823                 goto error;
1824         }
1825
1826 @@ -876,6 +884,56 @@
1827         }
1828  }
1829
1830 +static void jp2_uuid_destroy(jp2_box_t *box)
1831 +{
1832 +       jp2_uuid_t *uuid = &box->data.uuid;
1833 +       if (uuid->data)
1834 +       {
1835 +           jas_free(uuid->data);
1836 +           uuid->data = NULL;
1837 +       }
1838 +}
1839 +
1840 +static int jp2_uuid_getdata(jp2_box_t *box, jas_stream_t *in)
1841 +{
1842 +       jp2_uuid_t *uuid = &box->data.uuid;
1843 +       int i;
1844 +
1845 +       for (i = 0; i < 16; i++)
1846 +       {
1847 +           if (jp2_getuint8(in, &uuid->uuid[i]))
1848 +               return -1;
1849 +       }
1850 +
1851 +       uuid->datalen = box->datalen - 16;
1852 +       uuid->data = jas_malloc(uuid->datalen * sizeof(uint_fast8_t));
1853 +       for (i = 0; i < uuid->datalen; i++)
1854 +       {
1855 +           if (jp2_getuint8(in, &uuid->data[i]))
1856 +               return -1;
1857 +       }
1858 +       return 0;
1859 +}
1860 +
1861 +static int jp2_uuid_putdata(jp2_box_t *box, jas_stream_t *out)
1862 +{
1863 +       jp2_uuid_t *uuid = &box->data.uuid;
1864 +       int i;
1865 +
1866 +       for (i = 0; i < 16; i++)
1867 +       {
1868 +           if (jp2_putuint8(out, uuid->uuid[i]))
1869 +               return -1;
1870 +       }
1871 +
1872 +       for (i = 0; i < uuid->datalen; i++)
1873 +       {
1874 +           if (jp2_putuint8(out, uuid->data[i]))
1875 +               return -1;
1876 +       }
1877 +       return 0;
1878 +}
1879 +
1880  static int jp2_getint(jas_stream_t *in, int s, int n, int_fast32_t *val)
1881  {
1882         int c;
1883 diff -ruN src/libjasper/jp2/jp2_cod.h.orig src/libjasper/jp2/jp2_cod.h
1884 --- src/libjasper/jp2/jp2_cod.h.orig    2007-01-20 05:43:05.000000000 +0800
1885 +++ src/libjasper/jp2/jp2_cod.h 2007-03-06 21:49:58.000000000 +0800
1886 @@ -5,6 +5,11 @@
1887   * All rights reserved.
1888   */
1889
1890 +/*
1891 + * Modified by Andrey Kiselev <dron@ak4719.spb.edu> to properly handle UUID
1892 + * box.
1893 + */
1894 +
1895  /* __START_OF_JASPER_LICENSE__
1896   *
1897   * JasPer License Version 2.0
1898 @@ -229,6 +234,12 @@
1899         jp2_cmapent_t *ents;
1900  } jp2_cmap_t;
1901
1902 +typedef struct {
1903 +       uint_fast32_t datalen;
1904 +       uint_fast8_t uuid[16];
1905 +       uint_fast8_t *data;
1906 +} jp2_uuid_t;
1907 +
1908  #define        JP2_CMAP_DIRECT         0
1909  #define        JP2_CMAP_PALETTE        1
1910
1911 @@ -257,6 +268,7 @@
1912                 jp2_pclr_t pclr;
1913                 jp2_cdef_t cdef;
1914                 jp2_cmap_t cmap;
1915 +               jp2_uuid_t uuid;
1916         } data;
1917
1918  } jp2_box_t;
1919 diff -ruN src/libjasper/jp2/jp2_enc.c.orig src/libjasper/jp2/jp2_enc.c
1920 --- src/libjasper/jp2/jp2_enc.c.orig    2007-01-20 05:43:05.000000000 +0800
1921 +++ src/libjasper/jp2/jp2_enc.c 2007-03-06 21:49:58.000000000 +0800
1922 @@ -5,6 +5,11 @@
1923   * All rights reserved.
1924   */
1925
1926 +/*
1927 + * Modified by Andrey Kiselev <dron@ak4719.spb.edu> to properly handle UUID
1928 + * box.
1929 + */
1930 +
1931  /* __START_OF_JASPER_LICENSE__
1932   *
1933   * JasPer License Version 2.0
1934 @@ -86,7 +91,7 @@
1935  * Functions.
1936  \******************************************************************************/
1937
1938 -int jp2_encode(jas_image_t *image, jas_stream_t *out, char *optstr)
1939 +int jp2_write_header(jas_image_t *image, jas_stream_t *out)
1940  {
1941         jp2_box_t *box;
1942         jp2_ftyp_t *ftyp;
1943 @@ -97,8 +102,6 @@
1944         long len;
1945         uint_fast16_t cmptno;
1946         jp2_colr_t *colr;
1947 -       char buf[4096];
1948 -       uint_fast32_t overhead;
1949         jp2_cdefchan_t *cdefchanent;
1950         jp2_cdef_t *cdef;
1951         int i;
1952 @@ -326,6 +329,26 @@
1953         jas_stream_close(tmpstream);
1954         tmpstream = 0;
1955
1956 +       return 0;
1957 +       abort();
1958 +
1959 +error:
1960 +
1961 +       if (box) {
1962 +               jp2_box_destroy(box);
1963 +       }
1964 +       if (tmpstream) {
1965 +               jas_stream_close(tmpstream);
1966 +       }
1967 +       return -1;
1968 +}
1969 +
1970 +int jp2_write_codestream(jas_image_t *image, jas_stream_t *out, char *optstr)
1971 +{
1972 +       jp2_box_t *box;
1973 +       char buf[4096];
1974 +       uint_fast32_t overhead;
1975 +
1976         /*
1977          * Output the contiguous code stream box.
1978          */
1979 @@ -358,12 +381,34 @@
1980         if (box) {
1981                 jp2_box_destroy(box);
1982         }
1983 -       if (tmpstream) {
1984 -               jas_stream_close(tmpstream);
1985 -       }
1986         return -1;
1987  }
1988
1989 +int jp2_encode(jas_image_t *image, jas_stream_t *out, char *optstr)
1990 +{
1991 +       if (jp2_write_header(image, out) < 0)
1992 +               return -1;
1993 +       if (jp2_write_codestream(image, out, optstr) < 0)
1994 +               return -1;
1995 +
1996 +       return 0;
1997 +}
1998 +
1999 +int jp2_encode_uuid(jas_image_t *image, jas_stream_t *out,
2000 +                   char *optstr, jp2_box_t *uuid)
2001 +{
2002 +       if (jp2_write_header(image, out) < 0)
2003 +               return -1;
2004 +       if (uuid) {
2005 +               if (jp2_box_put(uuid, out))
2006 +                       return -1;
2007 +       }
2008 +       if (jp2_write_codestream(image, out, optstr) < 0)
2009 +               return -1;
2010 +
2011 +       return 0;
2012 +}
2013 +
2014  static uint_fast32_t jp2_gettypeasoc(int colorspace, int ctype)
2015  {
2016         int type;
2017