Backport of the upstream commits:

From d91198abd00fc435a397fe6bad906a4c1748e9cf Mon Sep 17 00:00:00 2001
From: Michael Adams <mdadams@ece.uvic.ca>
Date: Sun, 23 Oct 2016 03:34:35 -0700
Subject: [PATCH] Fixed another integer overflow problem.

From a712a2041085e7cd5f2b153e1532ac2a2954ffaa Mon Sep 17 00:00:00 2001
From: Michael Adams <mdadams@ece.uvic.ca>
Date: Thu, 2 Mar 2017 09:28:42 -0800
Subject: [PATCH] Added some additional checking to prevent a potential integer
 overflow due to conversion in the JPC decoder.

diff -pruN jasper-1.900.1.orig/src/libjasper/jpc/jpc_dec.c jasper-1.900.1/src/libjasper/jpc/jpc_dec.c
--- jasper-1.900.1.orig/src/libjasper/jpc/jpc_dec.c	2017-03-31 22:12:06.000000000 +0200
+++ jasper-1.900.1/src/libjasper/jpc/jpc_dec.c	2017-03-31 22:14:46.112781219 +0200
@@ -1174,6 +1174,7 @@ static int jpc_dec_process_siz(jpc_dec_t
 	int htileno;
 	int vtileno;
 	jpc_dec_cmpt_t *cmpt;
+	size_t size;
 
 	dec->xstart = siz->xoff;
 	dec->ystart = siz->yoff;
@@ -1210,7 +1211,11 @@ static int jpc_dec_process_siz(jpc_dec_t
 
 	dec->numhtiles = JPC_CEILDIV(dec->xend - dec->tilexoff, dec->tilewidth);
 	dec->numvtiles = JPC_CEILDIV(dec->yend - dec->tileyoff, dec->tileheight);
-	dec->numtiles = dec->numhtiles * dec->numvtiles;
+	if (!jas_safe_size_mul(dec->numhtiles, dec->numvtiles, &size) ||
+		size > INT_MAX) {
+		return -1;
+	}
+	dec->numtiles = size;
 	if (!(dec->tiles = jas_calloc(dec->numtiles, sizeof(jpc_dec_tile_t)))) {
 		return -1;
 	}