From 1f0dfe5a42911b6880a1445f13f6d615ddb55387 Mon Sep 17 00:00:00 2001
From: Michael Adams <mdadams@ece.uvic.ca>
Date: Fri, 4 Nov 2016 07:20:23 -0700
Subject: [PATCH] Fixed an integer overflow problem in the JPC codec that later
 resulted in the use of uninitialized data.

---
 src/libjasper/jpc/jpc_t2cod.c | 20 ++++++++++----------
 src/libjasper/jpc/jpc_t2cod.h | 20 ++++++++++----------
 2 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/src/libjasper/jpc/jpc_t2cod.c b/src/libjasper/jpc/jpc_t2cod.c
index 08315dd..174442a 100644
--- a/src/libjasper/jpc/jpc_t2cod.c
+++ b/src/libjasper/jpc/jpc_t2cod.c
@@ -432,18 +432,18 @@ static int jpc_pi_nextcprl(register jpc_pi_t *pi)
 	  &pi->picomps[pi->compno]; pi->compno < JAS_CAST(int, pchg->compnoend) && pi->compno < pi->numcomps; ++pi->compno,
 	  ++pi->picomp) {
 		pirlvl = pi->picomp->pirlvls;
-		pi->xstep = pi->picomp->hsamp * (1 << (pirlvl->prcwidthexpn +
-		  pi->picomp->numrlvls - 1));
-		pi->ystep = pi->picomp->vsamp * (1 << (pirlvl->prcheightexpn +
-		  pi->picomp->numrlvls - 1));
+		pi->xstep = pi->picomp->hsamp * (JAS_CAST(uint_fast32_t, 1) <<
+		  (pirlvl->prcwidthexpn + pi->picomp->numrlvls - 1));
+		pi->ystep = pi->picomp->vsamp * (JAS_CAST(uint_fast32_t, 1) <<
+		  (pirlvl->prcheightexpn + pi->picomp->numrlvls - 1));
 		for (rlvlno = 1, pirlvl = &pi->picomp->pirlvls[1];
 		  rlvlno < pi->picomp->numrlvls; ++rlvlno, ++pirlvl) {
-			pi->xstep = JAS_MIN(pi->xstep, pi->picomp->hsamp * (1 <<
-			  (pirlvl->prcwidthexpn + pi->picomp->numrlvls -
-			  rlvlno - 1)));
-			pi->ystep = JAS_MIN(pi->ystep, pi->picomp->vsamp * (1 <<
-			  (pirlvl->prcheightexpn + pi->picomp->numrlvls -
-			  rlvlno - 1)));
+			pi->xstep = JAS_MIN(pi->xstep, pi->picomp->hsamp *
+			  (JAS_CAST(uint_fast32_t, 1) << (pirlvl->prcwidthexpn +
+			  pi->picomp->numrlvls - rlvlno - 1)));
+			pi->ystep = JAS_MIN(pi->ystep, pi->picomp->vsamp *
+			  (JAS_CAST(uint_fast32_t, 1) << (pirlvl->prcheightexpn +
+			  pi->picomp->numrlvls - rlvlno - 1)));
 		}
 		for (pi->y = pi->ystart; pi->y < pi->yend;
 		  pi->y += pi->ystep - (pi->y % pi->ystep)) {
diff --git a/src/libjasper/jpc/jpc_t2cod.h b/src/libjasper/jpc/jpc_t2cod.h
index 0a176c9..690e031 100644
--- a/src/libjasper/jpc/jpc_t2cod.h
+++ b/src/libjasper/jpc/jpc_t2cod.h
@@ -129,10 +129,10 @@ typedef struct {
 	jpc_pirlvl_t *pirlvls;
 
 	/* The horizontal sampling period. */
-	int hsamp;
+	uint_fast32_t hsamp;
 
 	/* The vertical sampling period. */
-	int vsamp;
+	uint_fast32_t vsamp;
 
 } jpc_picomp_t;
 
@@ -171,32 +171,32 @@ typedef struct {
 	int lyrno;
 
 	/* The x-coordinate of the current position. */
-	int x;
+	uint_fast32_t x;
 
 	/* The y-coordinate of the current position. */
-	int y;
+	uint_fast32_t y;
 
 	/* The horizontal step size. */
-	int xstep;
+	uint_fast32_t xstep;
 
 	/* The vertical step size. */
-	int ystep;
+	uint_fast32_t ystep;
 
 	/* The x-coordinate of the top-left corner of the tile on the reference
 	  grid. */
-	int xstart;
+	uint_fast32_t xstart;
 
 	/* The y-coordinate of the top-left corner of the tile on the reference
 	  grid. */
-	int ystart;
+	uint_fast32_t ystart;
 
 	/* The x-coordinate of the bottom-right corner of the tile on the
 	  reference grid (plus one). */
-	int xend;
+	uint_fast32_t xend;
 
 	/* The y-coordinate of the bottom-right corner of the tile on the
 	  reference grid (plus one). */
-	int yend;
+	uint_fast32_t yend;
 
 	/* The current progression change. */
 	jpc_pchg_t *pchg;