Backport of relevant parts of upstream commit:

From 1e84674d95353c64e5c4c0e7232ae86fd6ea813b Mon Sep 17 00:00:00 2001
From: Michael Adams <mdadams@ece.uvic.ca>
Date: Tue, 25 Oct 2016 07:01:50 -0700
Subject: [PATCH] Changed the JPC bitstream code to more gracefully handle a
 request for a larger sized integer than what can be handled (i.e., return
 with an error instead of failing an assert).

diff -pruN jasper-1.900.1.orig/src/libjasper/jpc/jpc_bs.c jasper-1.900.1/src/libjasper/jpc/jpc_bs.c
--- jasper-1.900.1.orig/src/libjasper/jpc/jpc_bs.c	2007-01-19 22:43:07.000000000 +0100
+++ jasper-1.900.1/src/libjasper/jpc/jpc_bs.c	2017-03-31 23:00:31.000000000 +0200
@@ -195,7 +195,10 @@ long jpc_bitstream_getbits(jpc_bitstream
 
 	/* We can reliably get at most 31 bits since ISO/IEC 9899 only
 	  guarantees that a long can represent values up to 2^31-1. */
-	assert(n >= 0 && n < 32);
+	//assert(n >= 0 && n < 32);
+	if (n < 0 || n >= 32) {
+		return -1;
+	}
 
 	/* Get the number of bits requested from the specified bit stream. */
 	v = 0;
@@ -215,7 +218,10 @@ int jpc_bitstream_putbits(jpc_bitstream_
 
 	/* We can reliably put at most 31 bits since ISO/IEC 9899 only
 	  guarantees that a long can represent values up to 2^31-1. */
-	assert(n >= 0 && n < 32);
+	//assert(n >= 0 && n < 32);
+	if (n < 0 || n >= 32) {
+		return EOF;
+	}
 	/* Ensure that only the bits to be output are nonzero. */
 	assert(!(v & (~JAS_ONES(n))));