CVE-2016-9583: Out-of-bounds Read (CWE-125)
value: An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2018-08-01T17:29Z
Repository: https://github.com/mdadams/jasper
Language: C
Files changed: src/libjasper/include/jasper/jas_types.h, src/libjasper/jpc/jpc_t2cod.c, src/libjasper/jpc/jpc_t2dec.c
Commit date: 2016-11-26 17:14:09 -0800
Commit message: Fixed numerous integer overflow problems in the code for packet iterators
in the JPC decoder.

Diff: diff --git a/src/libjasper/include/jasper/jas_types.h b/src/libjasper/include/jasper/jas_types.h
index bd83ca5..0d4a196 100644
--- a/src/libjasper/include/jasper/jas_types.h
+++ b/src/libjasper/include/jasper/jas_types.h
@@ -114,10 +114,14 @@
   macro, type casts can be easily located in the source code with
   tools like "grep". */
 #define	JAS_CAST(t, e) \
 	((t) (e))
 
+/* The number of bits in the integeral type uint_fast32_t. */
+/* NOTE: This could underestimate the size on some exotic architectures. */
+#define JAS_UINTFAST32_NUMBITS (8 * sizeof(uint_fast32_t))
+
 #ifdef __cplusplus
 extern "C" {
 #endif
 
 #ifdef __cplusplus
diff --git a/src/libjasper/jpc/jpc_t2cod.c b/src/libjasper/jpc/jpc_t2cod.c
index 679516f..5e2c862 100644
--- a/src/libjasper/jpc/jpc_t2cod.c
+++ b/src/libjasper/jpc/jpc_t2cod.c
@@ -196,11 +196,12 @@ static int jpc_pi_nextrlcp(register jpc_pi_t *pi)
 	  pi->rlvlno < pchg->rlvlnoend; ++pi->rlvlno) {
 		for (pi->lyrno = 0; pi->lyrno < pi->numlyrs && pi->lyrno <
 		  JAS_CAST(int, pchg->lyrnoend); ++pi->lyrno) {
 			for (pi->compno = pchg->compnostart, pi->picomp =
 			  &pi->picomps[pi->compno]; pi->compno < pi->numcomps &&
-			  pi->compno < JAS_CAST(int, pchg->compnoend); ++pi->compno, ++pi->picomp) {
+			  pi->compno < JAS_CAST(int, pchg->compnoend); ++pi->compno,
+			  ++pi->picomp) {
 				if (pi->rlvlno >= pi->picomp->numrlvls) {
 					continue;
 				}
 				pi->pirlvl = &pi->picomp->pirlvls[pi->rlvlno];
 				for (pi->prcno = 0, prclyrno = pi->pirlvl->prclyrnos;
@@ -245,14 +246,21 @@ static int jpc_pi_nextrpcl(register jpc_pi_t *pi)
 		pi->ystep = 0;
 		for (compno = 0, picomp = pi->picomps; compno < pi->numcomps;
 		  ++compno, ++picomp) {
 			for (rlvlno = 0, pirlvl = picomp->pirlvls; rlvlno <
 			  picomp->numrlvls; ++rlvlno, ++pirlvl) {
-				xstep = picomp->hsamp * (1 << (pirlvl->prcwidthexpn +
-				  picomp->numrlvls - rlvlno - 1));
-				ystep = picomp->vsamp * (1 << (pirlvl->prcheightexpn +
-				  picomp->numrlvls - rlvlno - 1));
+				// Check for the potential for overflow problems.
+				if (pirlvl->prcwidthexpn + pi->picomp->numrlvls >
+				  JAS_UINTFAST32_NUMBITS - 2 ||
+				  pirlvl->prcheightexpn + pi->picomp->numrlvls >
+				  JAS_UINTFAST32_NUMBITS - 2) {
+					return -1;
+				}
+				xstep = picomp->hsamp * (JAS_CAST(uint_fast32_t, 1) <<
+				  (pirlvl->prcwidthexpn + picomp->numrlvls - rlvlno - 1));
+				ystep = picomp->vsamp * (JAS_CAST(uint_fast32_t, 1) <<
+				  (pirlvl->prcheightexpn + picomp->numrlvls - rlvlno - 1));
 				pi->xstep = (!pi->xstep) ? xstep : JAS_MIN(pi->xstep, xstep);
 				pi->ystep = (!pi->ystep) ? ystep : JAS_MIN(pi->ystep, ystep);
 			}
 		}
 		pi->prgvolfirst = 0;
@@ -278,25 +286,28 @@ static int jpc_pi_nextrpcl(register jpc_pi_t *pi)
 					r = pi->picomp->numrlvls - 1 - pi->rlvlno;
 					rpx = r + pi->pirlvl->prcwidthexpn;
 					rpy = r + pi->pirlvl->prcheightexpn;
 					trx0 = JPC_CEILDIV(pi->xstart, pi->picomp->hsamp << r);
 					try0 = JPC_CEILDIV(pi->ystart, pi->picomp->vsamp << r);
-					if (((pi->x == pi->xstart && ((trx0 << r) % (1 << rpx)))
-					  || !(pi->x % (1 << rpx))) &&
-					  ((pi->y == pi->ystart && ((try0 << r) % (1 << rpy)))
-					  || !(pi->y % (1 << rpy)))) {
-						prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x, pi->picomp->hsamp
-						  << r), pi->pirlvl->prcwidthexpn) - JPC_FLOORDIVPOW2(trx0,
-						  pi->pirlvl->prcwidthexpn);
-						prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y, pi->picomp->vsamp
-						  << r), pi->pirlvl->prcheightexpn) - JPC_FLOORDIVPOW2(try0,
-						  pi->pirlvl->prcheightexpn);
+					if (((pi->x == pi->xstart &&
+					  ((trx0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpx)))
+					  || !(pi->x % (JAS_CAST(uint_fast32_t, 1) << rpx))) &&
+					  ((pi->y == pi->ystart &&
+					  ((try0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpy)))
+					  || !(pi->y % (JAS_CAST(uint_fast32_t, 1) << rpy)))) {
+						prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x,
+						  pi->picomp->hsamp << r), pi->pirlvl->prcwidthexpn) -
+						  JPC_FLOORDIVPOW2(trx0, pi->pirlvl->prcwidthexpn);
+						prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y,
+						  pi->picomp->vsamp << r), pi->pirlvl->prcheightexpn) -
+						  JPC_FLOORDIVPOW2(try0, pi->pirlvl->prcheightexpn);
 						pi->prcno = prcvind * pi->pirlvl->numhprcs + prchind;
 
 						assert(pi->prcno < pi->pirlvl->numprcs);
 						for (pi->lyrno = 0; pi->lyrno <
-						  pi->numlyrs && pi->lyrno < JAS_CAST(int, pchg->lyrnoend); ++pi->lyrno) {
+						  pi->numlyrs && pi->lyrno < JAS_CAST(int,
+						  pchg->lyrnoend); ++pi->lyrno) {
 							prclyrno = &pi->pirlvl->prclyrnos[pi->prcno];
 							if (pi->lyrno >= *prclyrno) {
 								++(*prclyrno);
 								return 0;
 							}
@@ -337,20 +348,23 @@ static int jpc_pi_nextpcrl(register jpc_pi_t *pi)
 		pi->ystep = 0;
 		for (compno = 0, picomp = pi->picomps; compno < pi->numcomps;
 		  ++compno, ++picomp) {
 			for (rlvlno = 0, pirlvl = picomp->pirlvls; rlvlno <
 			  picomp->numrlvls; ++rlvlno, ++pirlvl) {
-				xstep = picomp->hsamp * (1 <<
-				  (pirlvl->prcwidthexpn + picomp->numrlvls -
-				  rlvlno - 1));
-				ystep = picomp->vsamp * (1 <<
-				  (pirlvl->prcheightexpn + picomp->numrlvls -
-				  rlvlno - 1));
-				pi->xstep = (!pi->xstep) ? xstep :
-				  JAS_MIN(pi->xstep, xstep);
-				pi->ystep = (!pi->ystep) ? ystep :
-				  JAS_MIN(pi->ystep, ystep);
+				// Check for the potential for overflow problems.
+				if (pirlvl->prcwidthexpn + pi->picomp->numrlvls >
+				  JAS_UINTFAST32_NUMBITS - 2 ||
+				  pirlvl->prcheightexpn + pi->picomp->numrlvls >
+				  JAS_UINTFAST32_NUMBITS - 2) {
+					return -1;
+				}
+				xstep = picomp->hsamp * (JAS_CAST(uint_fast32_t, 1) <<
+				  (pirlvl->prcwidthexpn + picomp->numrlvls - rlvlno - 1));
+				ystep = picomp->vsamp * (JAS_CAST(uint_fast32_t, 1) <<
+				  (pirlvl->prcheightexpn + picomp->numrlvls - rlvlno - 1));
+				pi->xstep = (!pi->xstep) ? xstep : JAS_MIN(pi->xstep, xstep);
+				pi->ystep = (!pi->ystep) ? ystep : JAS_MIN(pi->ystep, ystep);
 			}
 		}
 		pi->prgvolfirst = 0;
 	}
 
@@ -373,24 +387,27 @@ static int jpc_pi_nextpcrl(register jpc_pi_t *pi)
 					r = pi->picomp->numrlvls - 1 - pi->rlvlno;
 					trx0 = JPC_CEILDIV(pi->xstart, pi->picomp->hsamp << r);
 					try0 = JPC_CEILDIV(pi->ystart, pi->picomp->vsamp << r);
 					rpx = r + pi->pirlvl->prcwidthexpn;
 					rpy = r + pi->pirlvl->prcheightexpn;
-					if (((pi->x == pi->xstart && ((trx0 << r) % (1 << rpx))) ||
+					if (((pi->x == pi->xstart &&
+					  ((trx0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpx))) ||
 					  !(pi->x % (pi->picomp->hsamp << rpx))) &&
-					  ((pi->y == pi->ystart && ((try0 << r) % (1 << rpy))) ||
+					  ((pi->y == pi->ystart &&
+					  ((try0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpy))) ||
 					  !(pi->y % (pi->picomp->vsamp << rpy)))) {
-						prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x, pi->picomp->hsamp
-						  << r), pi->pirlvl->prcwidthexpn) - JPC_FLOORDIVPOW2(trx0,
-						  pi->pirlvl->prcwidthexpn);
-						prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y, pi->picomp->vsamp
-						  << r), pi->pirlvl->prcheightexpn) - JPC_FLOORDIVPOW2(try0,
-						  pi->pirlvl->prcheightexpn);
+						prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x,
+						  pi->picomp->hsamp << r), pi->pirlvl->prcwidthexpn) -
+						  JPC_FLOORDIVPOW2(trx0, pi->pirlvl->prcwidthexpn);
+						prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y,
+						  pi->picomp->vsamp << r), pi->pirlvl->prcheightexpn) -
+						  JPC_FLOORDIVPOW2(try0, pi->pirlvl->prcheightexpn);
 						pi->prcno = prcvind * pi->pirlvl->numhprcs + prchind;
 						assert(pi->prcno < pi->pirlvl->numprcs);
 						for (pi->lyrno = 0; pi->lyrno < pi->numlyrs &&
-						  pi->lyrno < JAS_CAST(int, pchg->lyrnoend); ++pi->lyrno) {
+						  pi->lyrno < JAS_CAST(int, pchg->lyrnoend);
+						  ++pi->lyrno) {
 							prclyrno = &pi->pirlvl->prclyrnos[pi->prcno];
 							if (pi->lyrno >= *prclyrno) {
 								++(*prclyrno);
 								return 0;
 							}
@@ -424,14 +441,21 @@ static int jpc_pi_nextcprl(register jpc_pi_t *pi)
 		goto skip;
 	} else {
 		pi->prgvolfirst = 0;
 	}
 
-	for (pi->compno = pchg->compnostart, pi->picomp =
-	  &pi->picomps[pi->compno]; pi->compno < JAS_CAST(int, pchg->compnoend) && pi->compno < pi->numcomps; ++pi->compno,
-	  ++pi->picomp) {
+	for (pi->compno = pchg->compnostart, pi->picomp = &pi->picomps[pi->compno];
+	  pi->compno < JAS_CAST(int, pchg->compnoend) && pi->compno < pi->numcomps;
+	  ++pi->compno, ++pi->picomp) {
 		pirlvl = pi->picomp->pirlvls;
+		// Check for the potential for overflow problems.
+		if (pirlvl->prcwidthexpn + pi->picomp->numrlvls >
+		  JAS_UINTFAST32_NUMBITS - 2 ||
+		  pirlvl->prcheightexpn + pi->picomp->numrlvls >
+		  JAS_UINTFAST32_NUMBITS - 2) {
+			return -1;
+		}
 		pi->xstep = pi->picomp->hsamp * (JAS_CAST(uint_fast32_t, 1) <<
 		  (pirlvl->prcwidthexpn + pi->picomp->numrlvls - 1));
 		pi->ystep = pi->picomp->vsamp * (JAS_CAST(uint_fast32_t, 1) <<
 		  (pirlvl->prcheightexpn + pi->picomp->numrlvls - 1));
 		for (rlvlno = 1, pirlvl = &pi->picomp->pirlvls[1];
@@ -457,27 +481,27 @@ static int jpc_pi_nextcprl(register jpc_pi_t *pi)
 					r = pi->picomp->numrlvls - 1 - pi->rlvlno;
 					trx0 = JPC_CEILDIV(pi->xstart, pi->picomp->hsamp << r);
 					try0 = JPC_CEILDIV(pi->ystart, pi->picomp->vsamp << r);
 					rpx = r + pi->pirlvl->prcwidthexpn;
 					rpy = r + pi->pirlvl->prcheightexpn;
-					if (((pi->x == pi->xstart && ((trx0 << r) % (1 << rpx))) ||
+					if (((pi->x == pi->xstart &&
+					  ((trx0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpx))) ||
 					  !(pi->x % (pi->picomp->hsamp << rpx))) &&
-					  ((pi->y == pi->ystart && ((try0 << r) % (1 << rpy))) ||
+					  ((pi->y == pi->ystart &&
+					  ((try0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpy))) ||
 					  !(pi->y % (pi->picomp->vsamp << rpy)))) {
-						prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x, pi->picomp->hsamp
-						  << r), pi->pirlvl->prcwidthexpn) - JPC_FLOORDIVPOW2(trx0,
-						  pi->pirlvl->prcwidthexpn);
-						prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y, pi->picomp->vsamp
-						  << r), pi->pirlvl->prcheightexpn) - JPC_FLOORDIVPOW2(try0,
-						  pi->pirlvl->prcheightexpn);
-						pi->prcno = prcvind *
-						  pi->pirlvl->numhprcs +
-						  prchind;
-						assert(pi->prcno <
-						  pi->pirlvl->numprcs);
-						for (pi->lyrno = 0; pi->lyrno <
-						  pi->numlyrs && pi->lyrno < JAS_CAST(int, pchg->lyrnoend); ++pi->lyrno) {
+						prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x,
+						  pi->picomp->hsamp << r), pi->pirlvl->prcwidthexpn) -
+						  JPC_FLOORDIVPOW2(trx0, pi->pirlvl->prcwidthexpn);
+						prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y,
+						  pi->picomp->vsamp << r), pi->pirlvl->prcheightexpn) -
+						  JPC_FLOORDIVPOW2(try0, pi->pirlvl->prcheightexpn);
+						pi->prcno = prcvind * pi->pirlvl->numhprcs + prchind;
+						assert(pi->prcno < pi->pirlvl->numprcs);
+						for (pi->lyrno = 0; pi->lyrno < pi->numlyrs &&
+						  pi->lyrno < JAS_CAST(int, pchg->lyrnoend);
+						  ++pi->lyrno) {
 							prclyrno = &pi->pirlvl->prclyrnos[pi->prcno];
 							if (pi->lyrno >= *prclyrno) {
 								++(*prclyrno);
 								return 0;
 							}
diff --git a/src/libjasper/jpc/jpc_t2dec.c b/src/libjasper/jpc/jpc_t2dec.c
index 8300f9b..34d01d5 100644
--- a/src/libjasper/jpc/jpc_t2dec.c
+++ b/src/libjasper/jpc/jpc_t2dec.c
@@ -421,43 +421,43 @@ int jpc_dec_decodepkts(jpc_dec_t *dec, jas_stream_t *pkthdrstream, jas_stream_t
 	int ret;
 
 	tile = dec->curtile;
 	pi = tile->pi;
 	for (;;) {
-if (!tile->pkthdrstream || jas_stream_peekc(tile->pkthdrstream) == EOF) {
-		switch (jpc_dec_lookahead(in)) {
-		case JPC_MS_EOC:
-		case JPC_MS_SOT:
-			return 0;
-			break;
-		case JPC_MS_SOP:
-		case JPC_MS_EPH:
-		case 0:
-			break;
-		default:
-			return -1;
-			break;
+		if (!tile->pkthdrstream || jas_stream_peekc(tile->pkthdrstream) == EOF) {
+			switch (jpc_dec_lookahead(in)) {
+			case JPC_MS_EOC:
+			case JPC_MS_SOT:
+				return 0;
+				break;
+			case JPC_MS_SOP:
+			case JPC_MS_EPH:
+			case 0:
+				break;
+			default:
+				return -1;
+				break;
+			}
 		}
-}
 		if ((ret = jpc_pi_next(pi))) {
 			return ret;
 		}
-if (dec->maxpkts >= 0 && dec->numpkts >= dec->maxpkts) {
-	jas_eprintf("warning: stopping decode prematurely as requested\n");
-	return 0;
-}
+		if (dec->maxpkts >= 0 && dec->numpkts >= dec->maxpkts) {
+			jas_eprintf("warning: stopping decode prematurely as requested\n");
+			return 0;
+		}
 		if (jas_getdbglevel() >= 1) {
 			jas_eprintf("packet offset=%08ld prg=%d cmptno=%02d "
 			  "rlvlno=%02d prcno=%03d lyrno=%02d\n", (long)
 			  jas_stream_getrwcount(in), jpc_pi_prg(pi), jpc_pi_cmptno(pi),
 			  jpc_pi_rlvlno(pi), jpc_pi_prcno(pi), jpc_pi_lyrno(pi));
 		}
-		if (jpc_dec_decodepkt(dec, pkthdrstream, in, jpc_pi_cmptno(pi), jpc_pi_rlvlno(pi),
-		  jpc_pi_prcno(pi), jpc_pi_lyrno(pi))) {
+		if (jpc_dec_decodepkt(dec, pkthdrstream, in, jpc_pi_cmptno(pi),
+		  jpc_pi_rlvlno(pi), jpc_pi_prcno(pi), jpc_pi_lyrno(pi))) {
 			return -1;
 		}
-++dec->numpkts;
+		++dec->numpkts;
 	}
 
 	return 0;
 }
 

Vulnerable code: 			  pi->compno < JAS_CAST(int, pchg->compnoend); ++pi->compno, ++pi->picomp) {
				xstep = picomp->hsamp * (1 << (pirlvl->prcwidthexpn +
				  picomp->numrlvls - rlvlno - 1));
				ystep = picomp->vsamp * (1 << (pirlvl->prcheightexpn +
				  picomp->numrlvls - rlvlno - 1));
					if (((pi->x == pi->xstart && ((trx0 << r) % (1 << rpx)))
					  || !(pi->x % (1 << rpx))) &&
					  ((pi->y == pi->ystart && ((try0 << r) % (1 << rpy)))
					  || !(pi->y % (1 << rpy)))) {
						prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x, pi->picomp->hsamp
						  << r), pi->pirlvl->prcwidthexpn) - JPC_FLOORDIVPOW2(trx0,
						  pi->pirlvl->prcwidthexpn);
						prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y, pi->picomp->vsamp
						  << r), pi->pirlvl->prcheightexpn) - JPC_FLOORDIVPOW2(try0,
						  pi->pirlvl->prcheightexpn);
						  pi->numlyrs && pi->lyrno < JAS_CAST(int, pchg->lyrnoend); ++pi->lyrno) {
				xstep = picomp->hsamp * (1 <<
				  (pirlvl->prcwidthexpn + picomp->numrlvls -
				  rlvlno - 1));
				ystep = picomp->vsamp * (1 <<
				  (pirlvl->prcheightexpn + picomp->numrlvls -
				  rlvlno - 1));
				pi->xstep = (!pi->xstep) ? xstep :
				  JAS_MIN(pi->xstep, xstep);
				pi->ystep = (!pi->ystep) ? ystep :
				  JAS_MIN(pi->ystep, ystep);
					if (((pi->x == pi->xstart && ((trx0 << r) % (1 << rpx))) ||
					  ((pi->y == pi->ystart && ((try0 << r) % (1 << rpy))) ||
						prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x, pi->picomp->hsamp
						  << r), pi->pirlvl->prcwidthexpn) - JPC_FLOORDIVPOW2(trx0,
						  pi->pirlvl->prcwidthexpn);
						prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y, pi->picomp->vsamp
						  << r), pi->pirlvl->prcheightexpn) - JPC_FLOORDIVPOW2(try0,
						  pi->pirlvl->prcheightexpn);
						  pi->lyrno < JAS_CAST(int, pchg->lyrnoend); ++pi->lyrno) {
	for (pi->compno = pchg->compnostart, pi->picomp =
	  &pi->picomps[pi->compno]; pi->compno < JAS_CAST(int, pchg->compnoend) && pi->compno < pi->numcomps; ++pi->compno,
	  ++pi->picomp) {
					if (((pi->x == pi->xstart && ((trx0 << r) % (1 << rpx))) ||
					  ((pi->y == pi->ystart && ((try0 << r) % (1 << rpy))) ||
						prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x, pi->picomp->hsamp
						  << r), pi->pirlvl->prcwidthexpn) - JPC_FLOORDIVPOW2(trx0,
						  pi->pirlvl->prcwidthexpn);
						prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y, pi->picomp->vsamp
						  << r), pi->pirlvl->prcheightexpn) - JPC_FLOORDIVPOW2(try0,
						  pi->pirlvl->prcheightexpn);
						pi->prcno = prcvind *
						  pi->pirlvl->numhprcs +
						  prchind;
						assert(pi->prcno <
						  pi->pirlvl->numprcs);
						for (pi->lyrno = 0; pi->lyrno <
						  pi->numlyrs && pi->lyrno < JAS_CAST(int, pchg->lyrnoend); ++pi->lyrno) {
if (!tile->pkthdrstream || jas_stream_peekc(tile->pkthdrstream) == EOF) {
		switch (jpc_dec_lookahead(in)) {
		case JPC_MS_EOC:
		case JPC_MS_SOT:
			return 0;
			break;
		case JPC_MS_SOP:
		case JPC_MS_EPH:
		case 0:
			break;
		default:
			return -1;
			break;
}
if (dec->maxpkts >= 0 && dec->numpkts >= dec->maxpkts) {
	jas_eprintf("warning: stopping decode prematurely as requested\n");
	return 0;
}
		if (jpc_dec_decodepkt(dec, pkthdrstream, in, jpc_pi_cmptno(pi), jpc_pi_rlvlno(pi),
		  jpc_pi_prcno(pi), jpc_pi_lyrno(pi))) {
++dec->numpkts;
Fixed code: /* The number of bits in the integeral type uint_fast32_t. */
/* NOTE: This could underestimate the size on some exotic architectures. */
#define JAS_UINTFAST32_NUMBITS (8 * sizeof(uint_fast32_t))

			  pi->compno < JAS_CAST(int, pchg->compnoend); ++pi->compno,
			  ++pi->picomp) {
				// Check for the potential for overflow problems.
				if (pirlvl->prcwidthexpn + pi->picomp->numrlvls >
				  JAS_UINTFAST32_NUMBITS - 2 ||
				  pirlvl->prcheightexpn + pi->picomp->numrlvls >
				  JAS_UINTFAST32_NUMBITS - 2) {
					return -1;
				}
				xstep = picomp->hsamp * (JAS_CAST(uint_fast32_t, 1) <<
				  (pirlvl->prcwidthexpn + picomp->numrlvls - rlvlno - 1));
				ystep = picomp->vsamp * (JAS_CAST(uint_fast32_t, 1) <<
				  (pirlvl->prcheightexpn + picomp->numrlvls - rlvlno - 1));
					if (((pi->x == pi->xstart &&
					  ((trx0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpx)))
					  || !(pi->x % (JAS_CAST(uint_fast32_t, 1) << rpx))) &&
					  ((pi->y == pi->ystart &&
					  ((try0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpy)))
					  || !(pi->y % (JAS_CAST(uint_fast32_t, 1) << rpy)))) {
						prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x,
						  pi->picomp->hsamp << r), pi->pirlvl->prcwidthexpn) -
						  JPC_FLOORDIVPOW2(trx0, pi->pirlvl->prcwidthexpn);
						prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y,
						  pi->picomp->vsamp << r), pi->pirlvl->prcheightexpn) -
						  JPC_FLOORDIVPOW2(try0, pi->pirlvl->prcheightexpn);
						  pi->numlyrs && pi->lyrno < JAS_CAST(int,
						  pchg->lyrnoend); ++pi->lyrno) {
				// Check for the potential for overflow problems.
				if (pirlvl->prcwidthexpn + pi->picomp->numrlvls >
				  JAS_UINTFAST32_NUMBITS - 2 ||
				  pirlvl->prcheightexpn + pi->picomp->numrlvls >
				  JAS_UINTFAST32_NUMBITS - 2) {
					return -1;
				}
				xstep = picomp->hsamp * (JAS_CAST(uint_fast32_t, 1) <<
				  (pirlvl->prcwidthexpn + picomp->numrlvls - rlvlno - 1));
				ystep = picomp->vsamp * (JAS_CAST(uint_fast32_t, 1) <<
				  (pirlvl->prcheightexpn + picomp->numrlvls - rlvlno - 1));
				pi->xstep = (!pi->xstep) ? xstep : JAS_MIN(pi->xstep, xstep);
				pi->ystep = (!pi->ystep) ? ystep : JAS_MIN(pi->ystep, ystep);
					if (((pi->x == pi->xstart &&
					  ((trx0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpx))) ||
					  ((pi->y == pi->ystart &&
					  ((try0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpy))) ||
						prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x,
						  pi->picomp->hsamp << r), pi->pirlvl->prcwidthexpn) -
						  JPC_FLOORDIVPOW2(trx0, pi->pirlvl->prcwidthexpn);
						prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y,
						  pi->picomp->vsamp << r), pi->pirlvl->prcheightexpn) -
						  JPC_FLOORDIVPOW2(try0, pi->pirlvl->prcheightexpn);
						  pi->lyrno < JAS_CAST(int, pchg->lyrnoend);
						  ++pi->lyrno) {
	for (pi->compno = pchg->compnostart, pi->picomp = &pi->picomps[pi->compno];
	  pi->compno < JAS_CAST(int, pchg->compnoend) && pi->compno < pi->numcomps;
	  ++pi->compno, ++pi->picomp) {
		// Check for the potential for overflow problems.
		if (pirlvl->prcwidthexpn + pi->picomp->numrlvls >
		  JAS_UINTFAST32_NUMBITS - 2 ||
		  pirlvl->prcheightexpn + pi->picomp->numrlvls >
		  JAS_UINTFAST32_NUMBITS - 2) {
			return -1;
		}
					if (((pi->x == pi->xstart &&
					  ((trx0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpx))) ||
					  ((pi->y == pi->ystart &&
					  ((try0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpy))) ||
						prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x,
						  pi->picomp->hsamp << r), pi->pirlvl->prcwidthexpn) -
						  JPC_FLOORDIVPOW2(trx0, pi->pirlvl->prcwidthexpn);
						prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y,
						  pi->picomp->vsamp << r), pi->pirlvl->prcheightexpn) -
						  JPC_FLOORDIVPOW2(try0, pi->pirlvl->prcheightexpn);
						pi->prcno = prcvind * pi->pirlvl->numhprcs + prchind;
						assert(pi->prcno < pi->pirlvl->numprcs);
						for (pi->lyrno = 0; pi->lyrno < pi->numlyrs &&
						  pi->lyrno < JAS_CAST(int, pchg->lyrnoend);
						  ++pi->lyrno) {
		if (!tile->pkthdrstream || jas_stream_peekc(tile->pkthdrstream) == EOF) {
			switch (jpc_dec_lookahead(in)) {
			case JPC_MS_EOC:
			case JPC_MS_SOT:
				return 0;
				break;
			case JPC_MS_SOP:
			case JPC_MS_EPH:
			case 0:
				break;
			default:
				return -1;
				break;
			}
		if (dec->maxpkts >= 0 && dec->numpkts >= dec->maxpkts) {
			jas_eprintf("warning: stopping decode prematurely as requested\n");
			return 0;
		}
		if (jpc_dec_decodepkt(dec, pkthdrstream, in, jpc_pi_cmptno(pi),
		  jpc_pi_rlvlno(pi), jpc_pi_prcno(pi), jpc_pi_lyrno(pi))) {
		++dec->numpkts;