CVE-2016-9557 (published 2017-03-23T18:59Z)

Integer overflow in jas_image.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (application crash) via a crafted file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/mdadams/jasper
commit_details: repo_url: https://github.com/mdadams/jasper
author: Michael Adams
author_date: 2016-11-11 16:27:34-08:00
msg: The generation of the configuration file jas_config.h has been completely
reworked in order to avoid pollution of the global namespace.

Some problematic types like uchar, ulong, and friends have been replaced
with names with a jas_ prefix.

An option max_samples has been added to the BMP and JPEG decoders to
restrict the maximum size of image that they can decode.  This change
was made as a (possibly temporary) fix to address security concerns.
A max_samples command-line option has also been added to imginfo.

Whether an image component (for jas_image_t) is stored in memory or on
disk is now based on the component size (rather than the image size).

Some debug log message were added.

Some new integer overflow checks were added.

Some new safe integer add/multiply functions were added.

More pre-C99 cruft was removed.  JasPer has numerous "hacks" to
handle pre-C99 compilers.  JasPer now assumes C99 support.  So, this
pre-C99 cruft is unnecessary and can be removed.

The regression jasper-doublefree-mem_close.jpg has been re-enabled.
Theoretically, it should work more predictably now.
repository: repo_url: https://github.com/mdadams/jasper
repo_name: jasper-software/jasper
description: Official Repository for the JasPer Image Coding Toolkit
repo_language: C
owner: mdadams
file_changes: filename: .gitignore
change_type: ModificationType.MODIFY
diff: @@ -40,6 +40,7 @@ Makefile.in
 
 # ./src/libjasper/include/jasper directory
 /src/libjasper/include/jasper/jas_config.h
-/src/libjasper/include/jasper/jas_config.h.in
-/src/libjasper/include/jasper/jas_config.h.in~
+/src/libjasper/include/jasper/jas_pconf.h
+/src/libjasper/include/jasper/jas_pconf.h.in
+/src/libjasper/include/jasper/jas_pconf.h.in~
 /src/libjasper/include/jasper/stamp-h1

programming_language: Shell
filename: configure.ac
change_type: ModificationType.MODIFY
diff: @@ -132,16 +132,6 @@ AH_TOP([
 /* If configure is being used, this symbol will be defined automatically
   at this point in the configuration header file. */
 
-#if defined(__GNUC__) && !defined(__clang__)
-#define JAS_ATTRIBUTE_DISABLE_USAN \
-  __attribute__((no_sanitize_undefined))
-#elif defined(__clang__)
-#define JAS_ATTRIBUTE_DISABLE_USAN \
-  __attribute__((no_sanitize("undefined")))
-#else
-#define JAS_ATTRIBUTE_DISABLE_USAN
-#endif
-
 /* The preprocessor symbol JAS_WIN_MSVC_BUILD should not be defined
   unless the JasPer software is being built under Microsoft Windows
   using Microsoft Visual C. */
@@ -153,7 +143,7 @@ AH_TOP([
 AH_BOTTOM([
 #else
 /* A configure-based build is not being used. */
-#include <jasper/jas_config2.h>
+#include <jasper/jas_pconf2.h>
 #endif
 
 #endif
@@ -312,31 +302,82 @@ AC_CHECK_LIB(m, main)
 # Check for header files.
 ############################################################
 
-AC_HEADER_STDC
-AC_CHECK_HEADERS(fcntl.h limits.h unistd.h stdint.h stdbool.h io.h windows.h sys/types.h sys/time.h stdlib.h stddef.h)
+dnl AC_HEADER_STDC
+AC_CHECK_HEADERS(fcntl.h io.h unistd.h windows.h sys/time.h sys/types.h)
+
+# Surely, there must be a better way to do this, but
+# let's just get something working for now.
+
+if test $ac_cv_header_fcntl_h = yes; then
+	AC_SUBST([JAS_HAVE_FCNTL_H], ["#define JAS_HAVE_FCNTL_H 1"])
+else
+	AC_SUBST([JAS_HAVE_FCNTL_H], ["#undef JAS_HAVE_FCNTL_H"])
+fi
+
+if test $ac_cv_header_io_h = yes; then
+	AC_SUBST([JAS_HAVE_IO_H], ["#define JAS_HAVE_IO_H 1"])
+else
+	AC_SUBST([JAS_HAVE_IO_H], ["#undef JAS_HAVE_IO_H"])
+fi
+
+if test $ac_cv_header_unistd_h = yes; then
+	AC_SUBST([JAS_HAVE_UNISTD_H], ["#define JAS_HAVE_UNISTD_H 1"])
+else
+	AC_SUBST([JAS_HAVE_UNISTD_H], ["#undef JAS_HAVE_UNISTD_H"])
+fi
+
+if test $ac_cv_header_windows_h = yes; then
+	AC_SUBST([JAS_HAVE_WINDOWS_H], ["#define JAS_HAVE_WINDOWS_H 1"])
+else
+	AC_SUBST([JAS_HAVE_WINDOWS_H], ["#undef JAS_HAVE_WINDOWS_H"])
+fi
+
+if test $ac_cv_header_sys_time_h = yes; then
+	AC_SUBST([JAS_HAVE_SYS_TIME_H], ["#define JAS_HAVE_SYS_TIME_H 1"])
+else
+	AC_SUBST([JAS_HAVE_SYS_TIME_H], ["#undef JAS_HAVE_SYS_TIME_H"])
+fi
+
+if test $ac_cv_header_sys_types_h = yes; then
+	AC_SUBST([JAS_HAVE_SYS_TYPES_H], ["#define JAS_HAVE_SYS_TYPES_H 1"])
+else
+	AC_SUBST([JAS_HAVE_SYS_TYPES_H], ["#undef JAS_HAVE_SYS_TYPES_H"])
+fi
 
 ############################################################
 # Check for typedefs, structures, and compiler characteristics.
 ############################################################
 
-AC_C_CONST
-AC_C_INLINE
-AC_TYPE_SIZE_T
-AC_CHECK_TYPE(uchar, unsigned char)
-AC_CHECK_TYPE(ushort, unsigned short)
-AC_CHECK_TYPE(uint, unsigned int)
-AC_CHECK_TYPE(ulong, unsigned long)
-AC_CHECK_TYPE(longlong, long long)
-AC_CHECK_TYPE(ulonglong, unsigned long long)
-AC_CHECK_TYPE(ssize_t, int)
+dnl AC_C_CONST
+dnl AC_C_INLINE
+dnl AC_TYPE_SIZE_T
+dnl AC_CHECK_TYPE(uchar, unsigned char)
+dnl AC_CHECK_TYPE(ushort, unsigned short)
+dnl AC_CHECK_TYPE(uint, unsigned int)
+dnl AC_CHECK_TYPE(ulong, unsigned long)
+dnl AC_CHECK_TYPE(longlong, long long)
+dnl AC_CHECK_TYPE(ulonglong, unsigned long long)
+dnl AC_CHECK_TYPE(ssize_t, int)
 AC_CHECK_FUNCS(gettimeofday)
 AC_CHECK_FUNCS(getrusage)
 
+if test $ac_cv_func_gettimeofday = yes; then
+	AC_SUBST([JAS_HAVE_GETTIMEOFDAY], ["#define JAS_HAVE_GETTIMEOFDAY 1"])
+else
+	AC_SUBST([JAS_HAVE_GETTIMEOFDAY], ["#undef JAS_HAVE_GETTIMEOFDAY"])
+fi
+
+if test $ac_cv_func_getrusage = yes; then
+	AC_SUBST([JAS_HAVE_GETRUSAGE], ["#define JAS_HAVE_GETRUSAGE 1"])
+else
+	AC_SUBST([JAS_HAVE_GETRUSAGE], ["#undef JAS_HAVE_GETRUSAGE"])
+fi
+
 ############################################################
 # Checks for library functions.
 ############################################################
 
-AC_FUNC_VPRINTF
+dnl AC_FUNC_VPRINTF
 
 ############################################################
 # Enable memory limit feature.
@@ -432,26 +473,9 @@ esac
 ], [debug=no])
 
 ############################################################
-# Extra stuff for research purposes.
+# Extra stuff
 ############################################################
 
-AC_ARG_ENABLE(special0,
-[  --enable-special0    enable something],
-[
-case "${enableval}" in
-yes)
-	if test "$GCC" = yes; then
-		CFLAGS="-g -O0"
-	fi
-	;;
-no)
-	;;
-*)
-	AC_MSG_ERROR(bad value ${enableval} for --enable-special0)
-	;;
-esac
-], [])
-
 if test -n "$EXTRA_CFLAGS"; then
 	CFLAGS="$CFLAGS $EXTRA_CFLAGS"
 fi
@@ -460,13 +484,17 @@ fi
 # Generate the configuration header file.
 ############################################################
 
-AC_CONFIG_HEADERS([src/libjasper/include/jasper/jas_config.h])
+# The private header file generated by AC_CONFIG_HEADERS is not
+# currently used.  This just causes less verbose command lines
+# when make is run.
+AC_CONFIG_HEADERS([src/libjasper/include/jasper/jas_pconf.h])
 
 ############################################################
 # Generate the makefiles.
 ############################################################
 
 AC_CONFIG_FILES([
+src/libjasper/include/jasper/jas_config.h
 Makefile
 src/Makefile
 src/appl/Makefile

programming_language: Shell
filename: imginfo.c
change_type: ModificationType.MODIFY
diff: @@ -88,6 +88,7 @@ typedef enum {
 	OPT_VERBOSE,
 	OPT_INFILE,
 	OPT_DEBUG,
+	OPT_MAXSAMPLES,
 	OPT_MAXMEM
 } optid_t;
 
@@ -108,6 +109,7 @@ static jas_opt_t opts[] = {
 	{OPT_VERBOSE, "verbose", 0},
 	{OPT_INFILE, "f", JAS_OPT_HASARG},
 	{OPT_DEBUG, "debug-level", JAS_OPT_HASARG},
+	{OPT_MAXSAMPLES, "max-samples", JAS_OPT_HASARG},
 #if defined(JAS_DEFAULT_MAX_MEM_USAGE)
 	{OPT_MAXMEM, "memory-limit", JAS_OPT_HASARG},
 #endif
@@ -135,6 +137,8 @@ int main(int argc, char **argv)
 	char *fmtname;
 	int debug;
 	size_t max_mem;
+	size_t max_samples;
+	char optstr[32];
 
 	if (jas_init()) {
 		abort();
@@ -142,6 +146,7 @@ int main(int argc, char **argv)
 
 	cmdname = argv[0];
 
+	max_samples = 64 * JAS_MEBI;
 	infile = 0;
 	verbose = 0;
 	debug = 0;
@@ -165,6 +170,9 @@ int main(int argc, char **argv)
 		case OPT_INFILE:
 			infile = jas_optarg;
 			break;
+		case OPT_MAXSAMPLES:
+			max_samples = strtoull(jas_optarg, 0, 10);
+			break;
 		case OPT_MAXMEM:
 			max_mem = strtoull(jas_optarg, 0, 10);
 			break;
@@ -199,8 +207,10 @@ int main(int argc, char **argv)
 		fprintf(stderr, "unknown image format\n");
 	}
 
+	snprintf(optstr, sizeof(optstr), "max_samples=%-zu", max_samples);
+
 	/* Decode the image. */
-	if (!(image = jas_image_decode(instream, fmtid, 0))) {
+	if (!(image = jas_image_decode(instream, fmtid, optstr))) {
 		jas_stream_close(instream);
 		fprintf(stderr, "cannot load image\n");
 		return EXIT_FAILURE;
@@ -209,6 +219,11 @@ int main(int argc, char **argv)
 	/* Close the image file. */
 	jas_stream_close(instream);
 
+	if (!(fmtname = jas_image_fmttostr(fmtid))) {
+		jas_eprintf("format name lookup failed\n");
+		return EXIT_FAILURE;
+	}
+
 	if (!(numcmpts = jas_image_numcmpts(image))) {
 		fprintf(stderr, "warning: image has no components\n");
 	}
@@ -221,10 +236,8 @@ int main(int argc, char **argv)
 		height = 0;
 		depth = 0;
 	}
-	if (!(fmtname = jas_image_fmttostr(fmtid))) {
-		abort();
-	}
-	printf("%s %d %d %d %d %ld\n", fmtname, numcmpts, width, height, depth, (long) jas_image_rawsize(image));
+	printf("%s %d %d %d %d %ld\n", fmtname, numcmpts, width, height, depth,
+	  JAS_CAST(long, jas_image_rawsize(image)));
 
 	jas_image_destroy(image);
 	jas_image_clearfmts();

programming_language: C
filename: jas_debug.c
change_type: ModificationType.MODIFY
diff: @@ -122,7 +122,7 @@ int jas_memdump(FILE *out, void *data, size_t len)
 {
 	size_t i;
 	size_t j;
-	uchar *dp;
+	jas_uchar *dp;
 	dp = data;
 	for (i = 0; i < len; i += 16) {
 		fprintf(out, "%04zx:", i);

programming_language: C++
filename: jas_icc.c
change_type: ModificationType.MODIFY
diff: @@ -82,14 +82,14 @@
 
 static jas_iccattrval_t *jas_iccattrval_create0(void);
 
-static int jas_iccgetuint(jas_stream_t *in, int n, ulonglong *val);
+static int jas_iccgetuint(jas_stream_t *in, int n, jas_ulonglong *val);
 static int jas_iccgetuint8(jas_stream_t *in, jas_iccuint8_t *val);
 static int jas_iccgetuint16(jas_stream_t *in, jas_iccuint16_t *val);
 static int jas_iccgetsint32(jas_stream_t *in, jas_iccsint32_t *val);
 static int jas_iccgetuint32(jas_stream_t *in, jas_iccuint32_t *val);
 static int jas_iccgetuint64(jas_stream_t *in, jas_iccuint64_t *val);
-static int jas_iccputuint(jas_stream_t *out, int n, ulonglong val);
-static int jas_iccputsint(jas_stream_t *out, int n, longlong val);
+static int jas_iccputuint(jas_stream_t *out, int n, jas_ulonglong val);
+static int jas_iccputsint(jas_stream_t *out, int n, jas_longlong val);
 static jas_iccprof_t *jas_iccprof_create(void);
 static int jas_iccprof_readhdr(jas_stream_t *in, jas_icchdr_t *hdr);
 static int jas_iccprof_writehdr(jas_stream_t *out, jas_icchdr_t *hdr);
@@ -1603,11 +1603,11 @@ static void jas_icclut16_dump(jas_iccattrval_t *attrval, FILE *out)
 *
 \******************************************************************************/
 
-static int jas_iccgetuint(jas_stream_t *in, int n, ulonglong *val)
+static int jas_iccgetuint(jas_stream_t *in, int n, jas_ulonglong *val)
 {
 	int i;
 	int c;
-	ulonglong v;
+	jas_ulonglong v;
 	v = 0;
 	for (i = n; i > 0; --i) {
 		if ((c = jas_stream_getc(in)) == EOF)
@@ -1629,7 +1629,7 @@ static int jas_iccgetuint8(jas_stream_t *in, jas_iccuint8_t *val)
 
 static int jas_iccgetuint16(jas_stream_t *in, jas_iccuint16_t *val)
 {
-	ulonglong tmp;
+	jas_ulonglong tmp;
 	if (jas_iccgetuint(in, 2, &tmp))
 		return -1;
 	*val = tmp;
@@ -1638,17 +1638,17 @@ static int jas_iccgetuint16(jas_stream_t *in, jas_iccuint16_t *val)
 
 static int jas_iccgetsint32(jas_stream_t *in, jas_iccsint32_t *val)
 {
-	ulonglong tmp;
+	jas_ulonglong tmp;
 	if (jas_iccgetuint(in, 4, &tmp))
 		return -1;
-	*val = (tmp & 0x80000000) ? (-JAS_CAST(longlong, (((~tmp) &
-	  0x7fffffff) + 1))) : JAS_CAST(longlong, tmp);
+	*val = (tmp & 0x80000000) ? (-JAS_CAST(jas_longlong, (((~tmp) &
+	  0x7fffffff) + 1))) : JAS_CAST(jas_longlong, tmp);
 	return 0;
 }
 
 static int jas_iccgetuint32(jas_stream_t *in, jas_iccuint32_t *val)
 {
-	ulonglong tmp;
+	jas_ulonglong tmp;
 	if (jas_iccgetuint(in, 4, &tmp))
 		return -1;
 	*val = tmp;
@@ -1657,14 +1657,14 @@ static int jas_iccgetuint32(jas_stream_t *in, jas_iccuint32_t *val)
 
 static int jas_iccgetuint64(jas_stream_t *in, jas_iccuint64_t *val)
 {
-	ulonglong tmp;
+	jas_ulonglong tmp;
 	if (jas_iccgetuint(in, 8, &tmp))
 		return -1;
 	*val = tmp;
 	return 0;
 }
 
-static int jas_iccputuint(jas_stream_t *out, int n, ulonglong val)
+static int jas_iccputuint(jas_stream_t *out, int n, jas_ulonglong val)
 {
 	int i;
 	int c;
@@ -1676,9 +1676,9 @@ static int jas_iccputuint(jas_stream_t *out, int n, ulonglong val)
 	return 0;
 }
 
-static int jas_iccputsint(jas_stream_t *out, int n, longlong val)
+static int jas_iccputsint(jas_stream_t *out, int n, jas_longlong val)
 {
-	ulonglong tmp;
+	jas_ulonglong tmp;
 	tmp = (val < 0) ? (abort(), 0) : val;
 	return jas_iccputuint(out, n, tmp);
 }
@@ -1719,7 +1719,7 @@ static long jas_iccpowi(int x, int n)
 }
 
 
-jas_iccprof_t *jas_iccprof_createfrombuf(uchar *buf, int len)
+jas_iccprof_t *jas_iccprof_createfrombuf(jas_uchar *buf, int len)
 {
 	jas_stream_t *in;
 	jas_iccprof_t *prof;

programming_language: C
filename: jas_iccdata.c
change_type: ModificationType.MODIFY
diff: @@ -62,7 +62,7 @@
 #include <jasper/jas_config.h>
 #include <jasper/jas_types.h>
 
-uchar jas_iccprofdata_srgb[] =
+jas_uchar jas_iccprofdata_srgb[] =
 {
 	0x00, 0x00, 0x0c, 0x48, 0x4c, 0x69, 0x6e, 0x6f,
 	0x02, 0x10, 0x00, 0x00, 0x6d, 0x6e, 0x74, 0x72,
@@ -461,7 +461,7 @@ uchar jas_iccprofdata_srgb[] =
 
 int jas_iccprofdata_srgblen = sizeof(jas_iccprofdata_srgb);
 
-uchar jas_iccprofdata_sgray[] = {
+jas_uchar jas_iccprofdata_sgray[] = {
 	0x00, 0x00, 0x01, 0x8a, 0x00, 0x00, 0x00, 0x00,
 	0x02, 0x20, 0x00, 0x00, 0x73, 0x63, 0x6e, 0x72,
 	0x47, 0x52, 0x41, 0x59, 0x58, 0x59, 0x5a, 0x20,

programming_language: C
filename: jas_image.c
change_type: ModificationType.MODIFY
diff: @@ -133,30 +133,35 @@ jas_image_t *jas_image_create(int numcmpts, jas_image_cmptparm_t *cmptparms,
   int clrspc)
 {
 	jas_image_t *image;
-	uint_fast32_t rawsize;
+	size_t rawsize;
 	uint_fast32_t inmem;
 	int cmptno;
 	jas_image_cmptparm_t *cmptparm;
 
+	image = 0;
+
+	JAS_DBGLOG(100, ("jas_image_create(%d, %p, %d)\n", numcmpts, cmptparms,
+	  clrspc));
+
 	if (!(image = jas_image_create0())) {
-		return 0;
+		goto error;
 	}
 
 	image->clrspc_ = clrspc;
 	image->maxcmpts_ = numcmpts;
-	image->inmem_ = true;
+//	image->inmem_ = true;
 
 	/* Allocate memory for the per-component information. */
 	if (!(image->cmpts_ = jas_alloc2(image->maxcmpts_,
 	  sizeof(jas_image_cmpt_t *)))) {
-		jas_image_destroy(image);
-		return 0;
+		goto error;
 	}
 	/* Initialize in case of failure. */
 	for (cmptno = 0; cmptno < image->maxcmpts_; ++cmptno) {
 		image->cmpts_[cmptno] = 0;
 	}
 
+#if 0
 	/* Compute the approximate raw size of the image. */
 	rawsize = 0;
 	for (cmptno = 0, cmptparm = cmptparms; cmptno < numcmpts; ++cmptno,
@@ -167,16 +172,22 @@ jas_image_t *jas_image_create(int numcmpts, jas_image_cmptparm_t *cmptparms,
 	/* Decide whether to buffer the image data in memory, based on the
 	  raw size of the image. */
 	inmem = (rawsize < JAS_IMAGE_INMEMTHRESH);
+#endif
 
 	/* Create the individual image components. */
 	for (cmptno = 0, cmptparm = cmptparms; cmptno < numcmpts; ++cmptno,
 	  ++cmptparm) {
+		if (!jas_safe_size_mul3(cmptparm->width, cmptparm->height,
+		  (cmptparm->prec + 7), &rawsize)) {
+			goto error;
+		}
+		rawsize /= 8;
+		inmem = (rawsize < JAS_IMAGE_INMEMTHRESH);
 		if (!(image->cmpts_[cmptno] = jas_image_cmpt_create(cmptparm->tlx,
 		  cmptparm->tly, cmptparm->hstep, cmptparm->vstep,
 		  cmptparm->width, cmptparm->height, cmptparm->prec,
 		  cmptparm->sgnd, inmem))) {
-			jas_image_destroy(image);
-			return 0;
+			goto error;
 		}
 		++image->numcmpts_;
 	}
@@ -186,6 +197,12 @@ jas_image_t *jas_image_create(int numcmpts, jas_image_cmptparm_t *cmptparms,
 	jas_image_setbbox(image);
 
 	return image;
+
+error:
+	if (image) {
+		jas_image_destroy(image);
+	}
+	return 0;
 }
 
 jas_image_t *jas_image_create0()
@@ -204,7 +221,7 @@ jas_image_t *jas_image_create0()
 	image->numcmpts_ = 0;
 	image->maxcmpts_ = 0;
 	image->cmpts_ = 0;
-	image->inmem_ = true;
+//	image->inmem_ = true;
 	image->cmprof_ = 0;
 
 	return image;
@@ -316,6 +333,19 @@ static jas_image_cmpt_t *jas_image_cmpt_create(int_fast32_t tlx,
 	jas_image_cmpt_t *cmpt;
 	size_t size;
 
+	JAS_DBGLOG(100, (
+	  "jas_image_cmpt_create(%ld, %ld, %ld, %ld, %ld, %ld, %d, %d, %d)\n",
+	  JAS_CAST(long, tlx),
+	  JAS_CAST(long, tly),
+	  JAS_CAST(long, hstep),
+	  JAS_CAST(long, vstep),
+	  JAS_CAST(long, width),
+	  JAS_CAST(long, height),
+	  JAS_CAST(int, depth),
+	  sgnd,
+	  inmem
+	  ));
+
 	cmpt = 0;
 	if (width < 0 || height < 0 || hstep <= 0 || vstep <= 0) {
 		goto error;
@@ -324,6 +354,9 @@ static jas_image_cmpt_t *jas_image_cmpt_create(int_fast32_t tlx,
 	  !jas_safe_intfast32_add(tly, height, 0)) {
 		goto error;
 	}
+	if (!jas_safe_intfast32_mul3(width, height, depth, 0)) {
+		goto error;
+	}
 
 	if (!(cmpt = jas_malloc(sizeof(jas_image_cmpt_t)))) {
 		goto error;
@@ -344,8 +377,7 @@ static jas_image_cmpt_t *jas_image_cmpt_create(int_fast32_t tlx,
 	// Compute the number of samples in the image component, while protecting
 	// against overflow.
 	// size = cmpt->width_ * cmpt->height_ * cmpt->cps_;
-	if (!jas_safe_size_mul(cmpt->width_, cmpt->height_, &size) ||
-	  !jas_safe_size_mul(size, cmpt->cps_, &size)) {
+	if (!jas_safe_size_mul3(cmpt->width_, cmpt->height_, cmpt->cps_, &size)) {
 		goto error;
 	}
 	cmpt->stream_ = (inmem) ? jas_stream_memopen2(0, size) :
@@ -1279,7 +1311,7 @@ static void jas_image_calcbbox2(jas_image_t *image, jas_image_coord_t *tlx,
 	*bry = tmpbry;
 }
 
-static inline long decode_twos_comp(ulong c, int prec)
+static inline long decode_twos_comp(jas_ulong c, int prec)
 {
 	long result;
 	assert(prec >= 2);
@@ -1289,9 +1321,9 @@ static inline long decode_twos_comp(ulong c, int prec)
 	return result;
 }
 
-static inline ulong encode_twos_comp(long n, int prec)
+static inline jas_ulong encode_twos_comp(long n, int prec)
 {
-	ulong result;
+	jas_ulong result;
 	assert(prec >= 2);
 	jas_eprintf("warning: support for signed data is untested\n");
 	// NOTE: Is this correct?
@@ -1332,7 +1364,7 @@ static int putint(jas_stream_t *out, int sgnd, int prec, long val)
 	int n;
 	int c;
 	bool s;
-	ulong tmp;
+	jas_ulong tmp;
 	assert((!sgnd && prec >= 1) || (sgnd && prec >= 2));
 	if (sgnd) {
 		val = encode_twos_comp(val, prec);

programming_language: C++
filename: jas_seq.c
change_type: ModificationType.MODIFY
diff: @@ -84,7 +84,8 @@
 * Constructors and destructors.
 \******************************************************************************/
 
-jas_matrix_t *jas_seq2d_create(int xstart, int ystart, int xend, int yend)
+jas_matrix_t *jas_seq2d_create(jas_matind_t xstart, jas_matind_t ystart,
+  jas_matind_t xend, jas_matind_t yend)
 {
 	jas_matrix_t *matrix;
 	assert(xstart <= xend && ystart <= yend);
@@ -98,10 +99,10 @@ jas_matrix_t *jas_seq2d_create(int xstart, int ystart, int xend, int yend)
 	return matrix;
 }
 
-jas_matrix_t *jas_matrix_create(int numrows, int numcols)
+jas_matrix_t *jas_matrix_create(jas_matind_t numrows, jas_matind_t numcols)
 {
 	jas_matrix_t *matrix;
-	int i;
+	jas_matind_t i;
 	size_t size;
 
 	matrix = 0;
@@ -180,8 +181,8 @@ void jas_matrix_destroy(jas_matrix_t *matrix)
 jas_seq2d_t *jas_seq2d_copy(jas_seq2d_t *x)
 {
 	jas_matrix_t *y;
-	int i;
-	int j;
+	jas_matind_t i;
+	jas_matind_t j;
 	y = jas_seq2d_create(jas_seq2d_xstart(x), jas_seq2d_ystart(x),
 	  jas_seq2d_xend(x), jas_seq2d_yend(x));
 	assert(y);
@@ -196,8 +197,8 @@ jas_seq2d_t *jas_seq2d_copy(jas_seq2d_t *x)
 jas_matrix_t *jas_matrix_copy(jas_matrix_t *x)
 {
 	jas_matrix_t *y;
-	int i;
-	int j;
+	jas_matind_t i;
+	jas_matind_t j;
 	y = jas_matrix_create(x->numrows_, x->numcols_);
 	for (i = 0; i < x->numrows_; ++i) {
 		for (j = 0; j < x->numcols_; ++j) {
@@ -211,17 +212,17 @@ jas_matrix_t *jas_matrix_copy(jas_matrix_t *x)
 * Bind operations.
 \******************************************************************************/
 
-void jas_seq2d_bindsub(jas_matrix_t *s, jas_matrix_t *s1, int xstart,
-  int ystart, int xend, int yend)
+void jas_seq2d_bindsub(jas_matrix_t *s, jas_matrix_t *s1, jas_matind_t xstart,
+  jas_matind_t ystart, jas_matind_t xend, jas_matind_t yend)
 {
 	jas_matrix_bindsub(s, s1, ystart - s1->ystart_, xstart - s1->xstart_,
 	  yend - s1->ystart_ - 1, xend - s1->xstart_ - 1);
 }
 
-void jas_matrix_bindsub(jas_matrix_t *mat0, jas_matrix_t *mat1, int r0,
-  int c0, int r1, int c1)
+void jas_matrix_bindsub(jas_matrix_t *mat0, jas_matrix_t *mat1,
+  jas_matind_t r0, jas_matind_t c0, jas_matind_t r1, jas_matind_t c1)
 {
-	int i;
+	jas_matind_t i;
 
 	if (mat0->data_) {
 		if (!(mat0->flags_ & JAS_MATRIX_REF)) {
@@ -265,8 +266,8 @@ void jas_matrix_bindsub(jas_matrix_t *mat0, jas_matrix_t *mat1, int r0,
 
 int jas_matrix_cmp(jas_matrix_t *mat0, jas_matrix_t *mat1)
 {
-	int i;
-	int j;
+	jas_matind_t i;
+	jas_matind_t j;
 
 	if (mat0->numrows_ != mat1->numrows_ || mat0->numcols_ !=
 	  mat1->numcols_) {
@@ -284,10 +285,10 @@ int jas_matrix_cmp(jas_matrix_t *mat0, jas_matrix_t *mat1)
 
 void jas_matrix_divpow2(jas_matrix_t *matrix, int n)
 {
-	int i;
-	int j;
+	jas_matind_t i;
+	jas_matind_t j;
 	jas_seqent_t *rowstart;
-	int rowstep;
+	jas_matind_t rowstep;
 	jas_seqent_t *data;
 
 	if (jas_matrix_numrows(matrix) > 0 && jas_matrix_numcols(matrix) > 0) {
@@ -307,12 +308,12 @@ void jas_matrix_divpow2(jas_matrix_t *matrix, int n)
 void jas_matrix_clip(jas_matrix_t *matrix, jas_seqent_t minval,
   jas_seqent_t maxval)
 {
-	int i;
-	int j;
+	jas_matind_t i;
+	jas_matind_t j;
 	jas_seqent_t v;
 	jas_seqent_t *rowstart;
 	jas_seqent_t *data;
-	int rowstep;
+	jas_matind_t rowstep;
 
 	if (jas_matrix_numrows(matrix) > 0 && jas_matrix_numcols(matrix) > 0) {
 		assert(matrix->rows_);
@@ -335,10 +336,10 @@ void jas_matrix_clip(jas_matrix_t *matrix, jas_seqent_t minval,
 
 void jas_matrix_asr(jas_matrix_t *matrix, int n)
 {
-	int i;
-	int j;
+	jas_matind_t i;
+	jas_matind_t j;
 	jas_seqent_t *rowstart;
-	int rowstep;
+	jas_matind_t rowstep;
 	jas_seqent_t *data;
 
 	assert(n >= 0);
@@ -358,10 +359,10 @@ void jas_matrix_asr(jas_matrix_t *matrix, int n)
 
 void jas_matrix_asl(jas_matrix_t *matrix, int n)
 {
-	int i;
-	int j;
+	jas_matind_t i;
+	jas_matind_t j;
 	jas_seqent_t *rowstart;
-	int rowstep;
+	jas_matind_t rowstep;
 	jas_seqent_t *data;
 
 	if (jas_matrix_numrows(matrix) > 0 && jas_matrix_numcols(matrix) > 0) {
@@ -382,10 +383,11 @@ void jas_matrix_asl(jas_matrix_t *matrix, int n)
 * Code.
 \******************************************************************************/
 
-int jas_matrix_resize(jas_matrix_t *matrix, int numrows, int numcols)
+int jas_matrix_resize(jas_matrix_t *matrix, jas_matind_t numrows,
+  jas_matind_t numcols)
 {
-	int size;
-	int i;
+	jas_matind_t size;
+	jas_matind_t i;
 
 	size = numrows * numcols;
 	if (size > matrix->datasize_ || numrows > matrix->maxrows_) {
@@ -404,10 +406,10 @@ int jas_matrix_resize(jas_matrix_t *matrix, int numrows, int numcols)
 
 void jas_matrix_setall(jas_matrix_t *matrix, jas_seqent_t val)
 {
-	int i;
-	int j;
+	jas_matind_t i;
+	jas_matind_t j;
 	jas_seqent_t *rowstart;
-	int rowstep;
+	jas_matind_t rowstep;
 	jas_seqent_t *data;
 
 	if (jas_matrix_numrows(matrix) > 0 && jas_matrix_numcols(matrix) > 0) {
@@ -426,20 +428,32 @@ void jas_matrix_setall(jas_matrix_t *matrix, jas_seqent_t val)
 jas_matrix_t *jas_seq2d_input(FILE *in)
 {
 	jas_matrix_t *matrix;
-	int i;
-	int j;
+	jas_matind_t i;
+	jas_matind_t j;
 	long x;
-	int numrows;
-	int numcols;
-	int xoff;
-	int yoff;
-
-	if (fscanf(in, "%d %d", &xoff, &yoff) != 2)
+	jas_matind_t numrows;
+	jas_matind_t numcols;
+	jas_matind_t xoff;
+	jas_matind_t yoff;
+	long tmp_xoff;
+	long tmp_yoff;
+	long tmp_numrows;
+	long tmp_numcols;
+
+	if (fscanf(in, "%ld %ld", &tmp_xoff, &tmp_yoff) != 2) {
 		return 0;
-	if (fscanf(in, "%d %d", &numcols, &numrows) != 2)
+	}
+	xoff = tmp_xoff;
+	yoff = tmp_yoff;
+	if (fscanf(in, "%ld %ld", &tmp_numcols, &tmp_numrows) != 2) {
 		return 0;
-	if (!(matrix = jas_seq2d_create(xoff, yoff, xoff + numcols, yoff + numrows)))
+	}
+	numrows = tmp_numrows;
+	numcols = tmp_numcols;
+	if (!(matrix = jas_seq2d_create(xoff, yoff, xoff + numcols,
+	  yoff + numrows))) {
 		return 0;
+	}
 
 	if (jas_matrix_numrows(matrix) != numrows ||
 	  jas_matrix_numcols(matrix) != numcols) {
@@ -463,8 +477,8 @@ jas_matrix_t *jas_seq2d_input(FILE *in)
 int jas_seq2d_output(jas_matrix_t *matrix, FILE *out)
 {
 #define MAXLINELEN	80
-	int i;
-	int j;
+	jas_matind_t i;
+	jas_matind_t j;
 	jas_seqent_t x;
 	char buf[MAXLINELEN + 1];
 	char sbuf[MAXLINELEN + 1];

programming_language: C++
filename: jas_stream.c
change_type: ModificationType.MODIFY
diff: @@ -71,18 +71,21 @@
 * Includes.
 \******************************************************************************/
 
+/* The configuration header file should be included first. */
+#include "jasper/jas_config.h"
+
 #include <assert.h>
-#if defined(HAVE_FCNTL_H)
+#if defined(JAS_HAVE_FCNTL_H)
 #include <fcntl.h>
 #endif
 #include <stdlib.h>
 #include <stdarg.h>
 #include <stdio.h>
 #include <ctype.h>
-#if defined(HAVE_UNISTD_H)
+#if defined(JAS_HAVE_UNISTD_H)
 #include <unistd.h>
 #endif
-#if defined(WIN32) || defined(HAVE_IO_H)
+#if defined(WIN32) || defined(JAS_HAVE_IO_H)
 #include <io.h>
 #endif
 
@@ -909,7 +912,7 @@ static void jas_stream_initbuf(jas_stream_t *stream, int bufmode, char *buf,
 			/* The buffer must be large enough to accommodate maximum
 			  putback. */
 			assert(bufsize > JAS_STREAM_MAXPUTBACK);
-			stream->bufbase_ = JAS_CAST(uchar *, buf);
+			stream->bufbase_ = JAS_CAST(jas_uchar *, buf);
 			stream->bufsize_ = bufsize - JAS_STREAM_MAXPUTBACK;
 		}
 	} else {

programming_language: C
filename: jas_tmr.c
change_type: ModificationType.MODIFY
diff: @@ -69,6 +69,9 @@
 * Includes.
 \******************************************************************************/
 
+/* The configuration header file should be included first. */
+#include "jasper/jas_config.h"
+
 #include <stdio.h>
 #include <stdlib.h>
 #include <time.h>
@@ -79,7 +82,7 @@
 * Code.
 \******************************************************************************/
 
-#if defined(HAVE_GETTIMEOFDAY)
+#if defined(JAS_HAVE_GETTIMEOFDAY)
 
 void jas_tmr_start(jas_tmr_t *tmr)
 {
@@ -104,7 +107,7 @@ double jas_tmr_get(jas_tmr_t *tmr)
 	return t1 - t0;
 }
 
-#elif defined(HAVE_GETRUSAGE)
+#elif defined(JAS_HAVE_GETRUSAGE)
 
 void jas_tmr_start(jas_tmr_t *tmr)
 {

programming_language: C
filename: bmp_dec.c
change_type: ModificationType.MODIFY
diff: @@ -78,9 +78,22 @@
 #include "jasper/jas_image.h"
 #include "jasper/jas_malloc.h"
 #include "jasper/jas_debug.h"
+#include "jasper/jas_tvp.h"
 
 #include "bmp_cod.h"
 
+/******************************************************************************\
+* Local types.
+\******************************************************************************/
+
+typedef struct {
+	size_t max_samples;
+} bmp_dec_importopts_t;
+
+typedef enum {
+	OPT_MAXSIZE,
+} optid_t;
+
 /******************************************************************************\
 * Local prototypes.
 \******************************************************************************/
@@ -92,6 +105,43 @@ static int bmp_getint16(jas_stream_t *in, int_fast16_t *val);
 static int bmp_getint32(jas_stream_t *in, int_fast32_t *val);
 static int bmp_gobble(jas_stream_t *in, long n);
 
+/******************************************************************************\
+* Option parsing.
+\******************************************************************************/
+
+static jas_taginfo_t decopts[] = {
+	{OPT_MAXSIZE, "max_samples"},
+	{-1, 0}
+};
+
+static int bmp_dec_parseopts(char *optstr, bmp_dec_importopts_t *opts)
+{
+	jas_tvparser_t *tvp;
+
+	opts->max_samples = 128 * JAS_MEBI;
+
+	if (!(tvp = jas_tvparser_create(optstr ? optstr : ""))) {
+		return -1;
+	}
+
+	while (!jas_tvparser_next(tvp)) {
+		switch (jas_taginfo_nonull(jas_taginfos_lookup(decopts,
+		  jas_tvparser_gettag(tvp)))->id) {
+		case OPT_MAXSIZE:
+			opts->max_samples = atoi(jas_tvparser_getval(tvp));
+			break;
+		default:
+			jas_eprintf("warning: ignoring invalid option %s\n",
+			  jas_tvparser_gettag(tvp));
+			break;
+		}
+	}
+
+	jas_tvparser_destroy(tvp);
+
+	return 0;
+}
+
 /******************************************************************************\
 * Interface functions.
 \******************************************************************************/
@@ -106,12 +156,14 @@ jas_image_t *bmp_decode(jas_stream_t *in, char *optstr)
 	jas_image_cmptparm_t *cmptparm;
 	uint_fast16_t numcmpts;
 	long n;
+	bmp_dec_importopts_t opts;
+	size_t num_samples;
 
 	image = 0;
 	info = 0;
 
-	if (optstr) {
-		jas_eprintf("warning: ignoring BMP decoder options\n");
+	if (bmp_dec_parseopts(optstr, &opts)) {
+		goto error;
 	}
 
 	jas_eprintf(
@@ -125,7 +177,6 @@ jas_image_t *bmp_decode(jas_stream_t *in, char *optstr)
 	if (bmp_gethdr(in, &hdr)) {
 		jas_eprintf("cannot get header\n");
 		goto error;
-		//return 0;
 	}
 	JAS_DBGLOG(1, (
 	  "BMP header: magic 0x%x; siz %d; res1 %d; res2 %d; off %d\n",
@@ -135,7 +186,6 @@ jas_image_t *bmp_decode(jas_stream_t *in, char *optstr)
 	/* Read the bitmap information. */
 	if (!(info = bmp_getinfo(in))) {
 		jas_eprintf("cannot get info\n");
-		//return 0;
 		goto error;
 	}
 	JAS_DBGLOG(1,
@@ -154,11 +204,21 @@ jas_image_t *bmp_decode(jas_stream_t *in, char *optstr)
 		goto error;
 	}
 
+	if (!jas_safe_size_mul3(info->width, info->height, info->numplanes,
+	  &num_samples)) {
+		jas_eprintf("image size too large\n");
+		goto error;
+	}
+
+	if (opts.max_samples > 0 && num_samples > opts.max_samples) {
+		jas_eprintf("maximum number of pixels exceeded (%zu)\n",
+		  opts.max_samples);
+		goto error;
+	}
+
 	/* Ensure that we support this type of BMP file. */
 	if (!bmp_issupported(&hdr, info)) {
 		jas_eprintf("error: unsupported BMP encoding\n");
-		//bmp_info_destroy(info);
-		//return 0;
 		goto error;
 	}
 
@@ -167,13 +227,10 @@ jas_image_t *bmp_decode(jas_stream_t *in, char *optstr)
 	if ((n = hdr.off - (BMP_HDRLEN + BMP_INFOLEN + BMP_PALLEN(info))) < 0) {
 		jas_eprintf("error: possibly bad bitmap offset?\n");
 		goto error;
-		//return 0;
 	}
 	if (n > 0) {
 		jas_eprintf("skipping unknown data in BMP file\n");
 		if (bmp_gobble(in, n)) {
-			//bmp_info_destroy(info);
-			//return 0;
 			goto error;
 		}
 	}
@@ -196,8 +253,6 @@ jas_image_t *bmp_decode(jas_stream_t *in, char *optstr)
 	/* Create image object. */
 	if (!(image = jas_image_create(numcmpts, cmptparms,
 	  JAS_CLRSPC_UNKNOWN))) {
-		//bmp_info_destroy(info);
-		//return 0;
 		goto error;
 	}
 
@@ -217,9 +272,6 @@ jas_image_t *bmp_decode(jas_stream_t *in, char *optstr)
 
 	/* Read the bitmap data. */
 	if (bmp_getdata(in, info, image)) {
-		//bmp_info_destroy(info);
-		//jas_image_destroy(image);
-		//return 0;
 		goto error;
 	}
 
@@ -241,7 +293,7 @@ int bmp_validate(jas_stream_t *in)
 {
 	int n;
 	int i;
-	uchar buf[2];
+	jas_uchar buf[2];
 
 	assert(JAS_STREAM_MAXPUTBACK >= 2);
 

programming_language: C++
filename: jas_cm.h
change_type: ModificationType.MODIFY
diff: @@ -68,7 +68,9 @@
 #ifndef JAS_CM_H
 #define JAS_CM_H
 
+/* The configuration header file should be included first. */
 #include <jasper/jas_config.h>
+
 #include <jasper/jas_icc.h>
 
 #ifdef __cplusplus

programming_language: C++
filename: jas_config.h.in
change_type: ModificationType.ADD
diff: @@ -0,0 +1,27 @@
+#ifndef JAS_CONFIG_H
+#define JAS_CONFIG_H
+
+/* This preprocessor symbol identifies the version of JasPer. */
+#define	JAS_VERSION "@JAS_VERSION@"
+
+@JAS_HAVE_FCNTL_H@
+@JAS_HAVE_IO_H@
+@JAS_HAVE_UNISTD_H@
+@JAS_HAVE_WINDOWS_H@
+@JAS_HAVE_SYS_TIME_H@
+@JAS_HAVE_SYS_TYPES_H@
+
+@JAS_HAVE_GETTIMEOFDAY@
+@JAS_HAVE_GETRUSAGE@
+
+#if defined(__GNUC__) && !defined(__clang__)
+#define JAS_ATTRIBUTE_DISABLE_USAN \
+  __attribute__((no_sanitize_undefined))
+#elif defined(__clang__)
+#define JAS_ATTRIBUTE_DISABLE_USAN \
+  __attribute__((no_sanitize("undefined")))
+#else
+#define JAS_ATTRIBUTE_DISABLE_USAN
+#endif
+
+#endif

programming_language: Shell
filename: jas_config2.h
change_type: ModificationType.MODIFY
diff: @@ -70,23 +70,10 @@
  * normally defined by configure.
  */
 
-#define	uchar		unsigned char
-#define	ushort		unsigned short
-#define	uint		unsigned int
-#define	ulong		unsigned long
-#undef longlong
-#define	longlong	long long
-#undef ulonglong
-#define	ulonglong	unsigned long long
-/*#define	ssize_t		int*/
-
 #define	HAVE_FCNTL_H		1
-#define	HAVE_LIMITS_H		1
 #define	HAVE_IO_H		1
 #define	HAVE_WINDOWS_H		1
 #define	HAVE_SYS_TYPES_H	1
-#define	HAVE_STDLIB_H		1
-#define	HAVE_STDDEF_H		1
 
 #ifndef __cplusplus
 #undef inline

programming_language: C
filename: jas_debug.h
change_type: ModificationType.MODIFY
diff: @@ -72,9 +72,11 @@
 * Includes.
 \******************************************************************************/
 
+/* The configuration header file should be included first. */
+#include <jasper/jas_config.h>
+
 #include <stdio.h>
 
-#include <jasper/jas_config.h>
 #include <jasper/jas_types.h>
 #include <jasper/jas_debug.h>
 

programming_language: C
filename: jas_fix.h
change_type: ModificationType.MODIFY
diff: @@ -74,11 +74,13 @@
 * Includes.
 \******************************************************************************/
 
+/* The configuration header file should be included first. */
+#include <jasper/jas_config.h>
+
 #include <stdio.h>
 #include <stdlib.h>
 #include <math.h>
 
-#include <jasper/jas_config.h>
 #include <jasper/jas_types.h>
 #include <jasper/jas_debug.h>
 

programming_language: C++
filename: jas_getopt.h
change_type: ModificationType.MODIFY
diff: @@ -74,6 +74,7 @@
 extern "C" {
 #endif
 
+/* The configuration header file should be included first. */
 #include <jasper/jas_config.h>
 
 /******************************************************************************\

programming_language: C
filename: jas_icc.h
change_type: ModificationType.MODIFY
diff: @@ -62,7 +62,9 @@
 #ifndef JAS_ICC_H
 #define	JAS_ICC_H
 
+/* The configuration header file should be included first. */
 #include <jasper/jas_config.h>
+
 #include <jasper/jas_types.h>
 #include <jasper/jas_stream.h>
 
@@ -252,10 +254,10 @@ typedef struct {
 	char *ascdata; /* ASCII invariant description */
 	jas_iccuint32_t uclangcode; /* Unicode language code */
 	jas_iccuint32_t uclen; /* Unicode localizable description count */
-	uchar *ucdata; /* Unicode localizable description */
+	jas_uchar *ucdata; /* Unicode localizable description */
 	jas_iccuint16_t sccode; /* ScriptCode code */
 	jas_iccuint8_t maclen; /* Localizable Macintosh description count */
-	uchar macdata[69]; /* Localizable Macintosh description */
+	jas_uchar macdata[69]; /* Localizable Macintosh description */
 } jas_icctxtdesc_t;
 
 /* Text type. */
@@ -393,11 +395,11 @@ jas_iccattrval_t *jas_iccattrval_create(jas_iccuint32_t type);
 
 void jas_iccattrtab_dump(jas_iccattrtab_t *attrtab, FILE *out);
 
-extern uchar jas_iccprofdata_srgb[];
+extern jas_uchar jas_iccprofdata_srgb[];
 extern int jas_iccprofdata_srgblen;
-extern uchar jas_iccprofdata_sgray[];
+extern jas_uchar jas_iccprofdata_sgray[];
 extern int jas_iccprofdata_sgraylen;
-jas_iccprof_t *jas_iccprof_createfrombuf(uchar *buf, int len);
+jas_iccprof_t *jas_iccprof_createfrombuf(jas_uchar *buf, int len);
 jas_iccprof_t *jas_iccprof_createfromclrspc(int clrspc);
 
 #ifdef __cplusplus

programming_language: C
filename: jas_image.h
change_type: ModificationType.MODIFY
diff: @@ -74,7 +74,9 @@
 * Includes.
 \******************************************************************************/
 
+/* The configuration header file should be included first. */
 #include <jasper/jas_config.h>
+
 #include <jasper/jas_stream.h>
 #include <jasper/jas_seq.h>
 #include <jasper/jas_cm.h>
@@ -217,7 +219,7 @@ typedef struct {
 
 	jas_cmprof_t *cmprof_;
 
-	bool inmem_;
+//	bool inmem_;
 
 } jas_image_t;
 

programming_language: C++
filename: jas_init.h
change_type: ModificationType.MODIFY
diff: @@ -62,6 +62,7 @@
 #ifndef JAS_INIT_H
 #define JAS_INIT_H
 
+/* The configuration header file should be included first. */
 #include <jasper/jas_config.h>
 
 #ifdef __cplusplus

programming_language: C
filename: jas_malloc.h
change_type: ModificationType.MODIFY
diff: @@ -74,6 +74,7 @@
 * Includes.
 \******************************************************************************/
 
+/* The configuration header file should be included first. */
 #include <jasper/jas_config.h>
 
 #include <stdlib.h>

programming_language: C
filename: jas_math.h
change_type: ModificationType.MODIFY
diff: @@ -74,7 +74,9 @@
 * Includes
 \******************************************************************************/
 
+/* The configuration header file should be included first. */
 #include <jasper/jas_config.h>
+
 #include <jasper/jas_types.h>
 
 #include <assert.h>
@@ -91,6 +93,9 @@ extern "C" {
 * Macros
 \******************************************************************************/
 
+#define JAS_KIBI	JAS_CAST(size_t, 1024)
+#define JAS_MEBI	(JAS_KIBI * JAS_KIBI)
+
 /* Compute the absolute value. */
 #define	JAS_ABS(x) \
 	(((x) >= 0) ? (x) : (-(x)))
@@ -187,6 +192,20 @@ inline static bool jas_safe_size_mul(size_t x, size_t y, size_t *result)
 	return true;
 }
 
+inline static bool jas_safe_size_mul3(size_t a, size_t b, size_t c,
+  size_t *result)
+{
+	size_t tmp;
+	if (!jas_safe_size_mul(a, b, &tmp) ||
+	  !jas_safe_size_mul(tmp, c, &tmp)) {
+		return false;
+	}
+	if (result) {
+		*result = tmp;
+	}
+	return true;
+}
+
 /* Compute the sum of two size_t integer with overflow checking. */
 inline static bool jas_safe_size_add(size_t x, size_t y, size_t *result)
 {
@@ -211,6 +230,57 @@ inline static bool jas_safe_size_sub(size_t x, size_t y, size_t *result)
 	return true;
 }
 
+/* Compute the sum of two size_t integer with overflow checking. */
+inline static bool jas_safe_intfast32_mul(int_fast32_t x, int_fast32_t y,
+  int_fast32_t *result)
+{
+	if (x > 0) {
+		/* x is positive */
+		if (y > 0) {
+			/* x and y are positive */
+			if (x > INT_FAST32_MAX / y) {
+				return false;
+			}
+		} else {
+			/* x positive, y nonpositive */
+			if (y < INT_FAST32_MIN / x) {
+				return false;
+			}
+		}
+	} else {
+		/* x is nonpositive */
+		if (y > 0) {
+			/* x is nonpositive, y is positive */
+			if (x < INT_FAST32_MIN / y) {
+				return false;
+			}
+		} else { /* x and y are nonpositive */
+			if (x != 0 && y < INT_FAST32_MAX / x) {
+				return false;
+			}
+		}
+	}
+
+	if (result) {
+		*result = x * y;
+	}
+	return true;
+}
+
+inline static bool jas_safe_intfast32_mul3(int_fast32_t a, int_fast32_t b,
+  int_fast32_t c, int_fast32_t *result)
+{
+	int_fast32_t tmp;
+	if (!jas_safe_intfast32_mul(a, b, &tmp) ||
+	  !jas_safe_intfast32_mul(tmp, c, &tmp)) {
+		return false;
+	}
+	if (result) {
+		*result = tmp;
+	}
+	return true;
+}
+
 /* Compute the sum of two size_t integer with overflow checking. */
 inline static bool jas_safe_intfast32_add(int_fast32_t x, int_fast32_t y,
   int_fast32_t *result)

programming_language: C++
filename: jas_seq.h
change_type: ModificationType.MODIFY
diff: @@ -74,6 +74,7 @@
 * Includes.
 \******************************************************************************/
 
+/* The configuration header file should be included first. */
 #include <jasper/jas_config.h>
 
 #include <jasper/jas_stream.h>
@@ -102,6 +103,8 @@ typedef int_fast32_t jas_seqent_t;
 /* An element in a matrix. */
 typedef int_fast32_t jas_matent_t;
 
+typedef int_fast32_t jas_matind_t;
+
 /* Matrix. */
 
 typedef struct {
@@ -110,22 +113,22 @@ typedef struct {
 	int flags_;
 
 	/* The starting horizontal index. */
-	int_fast32_t xstart_;
+	jas_matind_t xstart_;
 
 	/* The starting vertical index. */
-	int_fast32_t ystart_;
+	jas_matind_t ystart_;
 
 	/* The ending horizontal index. */
-	int_fast32_t xend_;
+	jas_matind_t xend_;
 
 	/* The ending vertical index. */
-	int_fast32_t yend_;
+	jas_matind_t yend_;
 
 	/* The number of rows in the matrix. */
-	int_fast32_t numrows_;
+	jas_matind_t numrows_;
 
 	/* The number of columns in the matrix. */
-	int_fast32_t numcols_;
+	jas_matind_t numcols_;
 
 	/* Pointers to the start of each row. */
 	jas_seqent_t **rows_;
@@ -182,25 +185,26 @@ typedef jas_matrix_t jas_seq_t;
 	(&(matrix)->rows_[i][j])
 
 #define	jas_matrix_getvref(matrix, i) \
-	(((matrix)->numrows_ > 1) ? jas_matrix_getref(matrix, i, 0) : jas_matrix_getref(matrix, 0, i))
+	(((matrix)->numrows_ > 1) ? jas_matrix_getref(matrix, i, 0) : \
+	  jas_matrix_getref(matrix, 0, i))
 
 #define jas_matrix_length(matrix) \
 	(max((matrix)->numrows_, (matrix)->numcols_))
 
 /* Create a matrix with the specified dimensions. */
-jas_matrix_t *jas_matrix_create(int numrows, int numcols);
+jas_matrix_t *jas_matrix_create(jas_matind_t numrows, jas_matind_t numcols);
 
 /* Destroy a matrix. */
 void jas_matrix_destroy(jas_matrix_t *matrix);
 
 /* Resize a matrix.  The previous contents of the matrix are lost. */
-int jas_matrix_resize(jas_matrix_t *matrix, int numrows, int numcols);
+int jas_matrix_resize(jas_matrix_t *matrix, jas_matind_t numrows, jas_matind_t numcols);
 
 int jas_matrix_output(jas_matrix_t *matrix, FILE *out);
 
 /* Create a matrix that references part of another matrix. */
-void jas_matrix_bindsub(jas_matrix_t *mat0, jas_matrix_t *mat1, int r0,
-  int c0, int r1, int c1);
+void jas_matrix_bindsub(jas_matrix_t *mat0, jas_matrix_t *mat1, jas_matind_t r0,
+  jas_matind_t c0, jas_matind_t r1, jas_matind_t c1);
 
 /* Create a matrix that is a reference to a row of another matrix. */
 #define jas_matrix_bindrow(mat0, mat1, r) \
@@ -250,7 +254,8 @@ jas_matrix_t *jas_matrix_input(FILE *);
 
 jas_seq2d_t *jas_seq2d_copy(jas_seq2d_t *x);
 
-jas_matrix_t *jas_seq2d_create(int xstart, int ystart, int xend, int yend);
+jas_matrix_t *jas_seq2d_create(jas_matind_t xstart, jas_matind_t ystart,
+  jas_matind_t xend, jas_matind_t yend);
 
 #define	jas_seq2d_destroy(s) \
 	jas_matrix_destroy(s)
@@ -280,8 +285,8 @@ jas_matrix_t *jas_seq2d_create(int xstart, int ystart, int xend, int yend);
 #define jas_seq2d_size(s) \
 	(jas_seq2d_width(s) * jas_seq2d_height(s))
 
-void jas_seq2d_bindsub(jas_matrix_t *s, jas_matrix_t *s1, int xstart,
-  int ystart, int xend, int yend);
+void jas_seq2d_bindsub(jas_matrix_t *s, jas_matrix_t *s1, jas_matind_t xstart,
+  jas_matind_t ystart, jas_matind_t xend, jas_matind_t yend);
 
 /******************************************************************************\
 * Functions/macros for 1-D sequence class.

programming_language: C
filename: jas_stream.h
change_type: ModificationType.MODIFY
diff: @@ -74,14 +74,15 @@
 * Includes.
 \******************************************************************************/
 
+/* The configuration header file should be included first. */
 #include <jasper/jas_config.h>
 
 #include <stdio.h>
-#if defined(HAVE_FCNTL_H)
+#if defined(JAS_HAVE_FCNTL_H)
 #include <fcntl.h>
 #endif
 #include <string.h>
-#if defined(HAVE_UNISTD_H)
+#if defined(JAS_HAVE_UNISTD_H)
 #include <unistd.h>
 #endif
 #include <jasper/jas_types.h>
@@ -208,24 +209,24 @@ typedef struct {
 	int flags_;
 
 	/* The start of the buffer area to use for reading/writing. */
-	uchar *bufbase_;
+	jas_uchar *bufbase_;
 
 	/* The start of the buffer area excluding the extra initial space for
 	  character putback. */
-	uchar *bufstart_;
+	jas_uchar *bufstart_;
 
 	/* The buffer size. */
 	int bufsize_;
 
 	/* The current position in the buffer. */
-	uchar *ptr_;
+	jas_uchar *ptr_;
 
 	/* The number of characters that must be read/written before
 	the buffer needs to be filled/flushed. */
 	int cnt_;
 
 	/* A trivial buffer to be used for unbuffered operation. */
-	uchar tinybuf_[JAS_STREAM_MAXPUTBACK + 1];
+	jas_uchar tinybuf_[JAS_STREAM_MAXPUTBACK + 1];
 
 	/* The operations for the underlying stream file object. */
 	jas_stream_ops_t *ops_;
@@ -264,7 +265,7 @@ typedef struct {
 typedef struct {
 
 	/* The data associated with this file. */
-	uchar *buf_;
+	jas_uchar *buf_;
 
 	/* The allocated size of the buffer for holding file data. */
 	size_t bufsize_;
@@ -451,7 +452,7 @@ directly, you will die a horrible, miserable, and painful death! */
 	  jas_stream_putc2(stream, c)) : EOF)
 #define jas_stream_putc2(stream, c) \
 	(((stream)->bufmode_ |= JAS_STREAM_WRBUF, --(stream)->cnt_ < 0) ? \
-	  jas_stream_flushbuf((stream), (uchar)(c)) : \
+	  jas_stream_flushbuf((stream), (jas_uchar)(c)) : \
 	  (++(stream)->rwcnt_, (int)(*(stream)->ptr_++ = (c))))
 
 /* These prototypes need to be here for the sake of the stream_getc and

programming_language: C++
filename: jas_string.h
change_type: ModificationType.MODIFY
diff: @@ -74,7 +74,9 @@
 * Includes.
 \******************************************************************************/
 
+/* The configuration header file should be included first. */
 #include <jasper/jas_config.h>
+
 #include <string.h>
 
 #ifdef __cplusplus

programming_language: C
filename: jas_tmr.h
change_type: ModificationType.MODIFY
diff: @@ -62,9 +62,11 @@
 #ifndef JAS_TMR_H
 #define JAS_TMR_H
 
-#include<time.h>
+/* The configuration header file should be included first. */
 #include <jasper/jas_config.h>
-#if defined(HAVE_SYS_TIME_H)
+
+#include<time.h>
+#if defined(JAS_HAVE_SYS_TIME_H)
 #include <sys/time.h>
 #endif
 
@@ -72,14 +74,14 @@
 extern "C" {
 #endif
 
-#if defined(HAVE_GETTIMEOFDAY)
+#if defined(JAS_HAVE_GETTIMEOFDAY)
 
 typedef struct {
 	struct timeval start;
 	struct timeval stop;
 } jas_tmr_t;
 
-#elif defined(HAVE_GETRUSAGE)
+#elif defined(JAS_HAVE_GETRUSAGE)
 
 typedef struct {
 	struct rusage start;

programming_language: C
filename: jas_tvp.h
change_type: ModificationType.MODIFY
diff: @@ -72,6 +72,7 @@
 * Includes.
 \******************************************************************************/
 
+/* The configuration header file should be included first. */
 #include <jasper/jas_config.h>
 
 #ifdef __cplusplus

programming_language: C
filename: jas_types.h
change_type: ModificationType.MODIFY
diff: @@ -70,11 +70,13 @@
 #ifndef JAS_TYPES_H
 #define JAS_TYPES_H
 
+/* The configuration header file should be included first. */
 #include <jasper/jas_config.h>
 
 #if !defined(JAS_CONFIGURE)
 
-#if defined(WIN32) || defined(HAVE_WINDOWS_H)
+#if defined(WIN32) || defined(JAS_HAVE_WINDOWS_H)
+// THIS SHOULD NO LONGER BE NEEDED SINCE MSVC SUPPORTS LONG LONG.
 /*
    We are dealing with Microsoft Windows and most likely Microsoft
    Visual C (MSVC).  (Heaven help us.)  Sadly, MSVC does not correctly
@@ -84,10 +86,10 @@
    and "UINT64" types that are defined in the header file "windows.h".
  */
 #include <windows.h>
-#undef longlong
-#define	longlong	INT64
-#undef ulonglong
-#define	ulonglong	UINT64
+//#undef longlong
+//#define	longlong	INT64
+//#undef ulonglong
+//#define	ulonglong	UINT64
 #endif
 
 #endif
@@ -98,29 +100,15 @@
 #include <stdbool.h>
 #include <stdint.h>
 
-#if defined(HAVE_SYS_TYPES_H)
+#if defined(JAS_HAVE_SYS_TYPES_H)
 #include <sys/types.h>
 #endif
 
-/* Hopefully, these macro definitions will fix more problems than they cause. */
-#if !defined(uchar)
-#define uchar unsigned char
-#endif
-#if !defined(ushort)
-#define ushort unsigned short
-#endif
-#if !defined(uint)
-#define uint unsigned int
-#endif
-#if !defined(ulong)
-#define ulong unsigned long
-#endif
-#if !defined(longlong)
-#define longlong long long
-#endif
-#if !defined(ulonglong)
-#define ulonglong unsigned long long
-#endif
+#define jas_uchar unsigned char
+#define jas_uint unsigned int
+#define jas_ulong unsigned long
+#define jas_longlong long long
+#define jas_ulonglong unsigned long long
 
 /* The below macro is intended to be used for type casts.  By using this
   macro, type casts can be easily located in the source code with

programming_language: C
filename: jas_version.h
change_type: ModificationType.MODIFY
diff: @@ -68,6 +68,7 @@
 #ifndef JAS_VERSION_H
 #define JAS_VERSION_H
 
+/* The configuration header file should be included first. */
 #include <jasper/jas_config.h>
 
 #ifdef __cplusplus

programming_language: C++
filename: jasper.h
change_type: ModificationType.MODIFY
diff: @@ -62,7 +62,9 @@
 #ifndef JAS_JASPER_H
 #define JAS_JASPER_H
 
+/* The configuration header file should be included first. */
 #include <jasper/jas_config.h>
+
 #include <jasper/jas_types.h>
 #include <jasper/jas_version.h>
 

programming_language: C
filename: jp2_dec.c
change_type: ModificationType.MODIFY
diff: @@ -77,6 +77,7 @@
 #include "jasper/jas_debug.h"
 #include "jasper/jas_malloc.h"
 #include "jasper/jas_version.h"
+#include "jasper/jas_types.h"
 
 #include "jp2_cod.h"
 #include "jp2_dec.h"
@@ -225,7 +226,7 @@ jas_image_t *jp2_decode(jas_stream_t *in, char *optstr)
 
 	/* Does the number of components indicated in the IHDR box match
 	  the value specified in the code stream? */
-	if (dec->ihdr->data.ihdr.numcmpts != JAS_CAST(uint,
+	if (dec->ihdr->data.ihdr.numcmpts != JAS_CAST(jas_uint,
 	  jas_image_numcmpts(dec->image))) {
 		jas_eprintf("warning: number of components mismatch\n");
 	}
@@ -239,7 +240,7 @@ jas_image_t *jp2_decode(jas_stream_t *in, char *optstr)
 	/* Determine if all components have the same data type. */
 	samedtype = true;
 	dtype = jas_image_cmptdtype(dec->image, 0);
-	for (i = 1; i < JAS_CAST(uint, jas_image_numcmpts(dec->image)); ++i) {
+	for (i = 1; i < JAS_CAST(jas_uint, jas_image_numcmpts(dec->image)); ++i) {
 		if (jas_image_cmptdtype(dec->image, i) != dtype) {
 			samedtype = false;
 			break;
@@ -262,14 +263,14 @@ jas_image_t *jp2_decode(jas_stream_t *in, char *optstr)
 	if (dec->bpcc) {
 		/* Is the number of components indicated in the BPCC box
 		  consistent with the code stream data? */
-		if (dec->bpcc->data.bpcc.numcmpts != JAS_CAST(uint, jas_image_numcmpts(
+		if (dec->bpcc->data.bpcc.numcmpts != JAS_CAST(jas_uint, jas_image_numcmpts(
 		  dec->image))) {
 			jas_eprintf("warning: number of components mismatch\n");
 		}
 		/* Is the component data type information indicated in the BPCC
 		  box consistent with the code stream data? */
 		if (!samedtype) {
-			for (i = 0; i < JAS_CAST(uint, jas_image_numcmpts(dec->image));
+			for (i = 0; i < JAS_CAST(jas_uint, jas_image_numcmpts(dec->image));
 			  ++i) {
 				if (jas_image_cmptdtype(dec->image, i) !=
 				  JP2_BPCTODTYPE(dec->bpcc->data.bpcc.bpcs[i])) {
@@ -324,13 +325,13 @@ jas_image_t *jp2_decode(jas_stream_t *in, char *optstr)
 	/* Determine the number of channels (which is essentially the number
 	  of components after any palette mappings have been applied). */
 	dec->numchans = dec->cmap ? dec->cmap->data.cmap.numchans :
-	  JAS_CAST(uint, jas_image_numcmpts(dec->image));
+	  JAS_CAST(jas_uint, jas_image_numcmpts(dec->image));
 
 	/* Perform a basic sanity check on the CMAP box if present. */
 	if (dec->cmap) {
 		for (i = 0; i < dec->numchans; ++i) {
 			/* Is the component number reasonable? */
-			if (dec->cmap->data.cmap.ents[i].cmptno >= JAS_CAST(uint,
+			if (dec->cmap->data.cmap.ents[i].cmptno >= JAS_CAST(jas_uint,
 			  jas_image_numcmpts(dec->image))) {
 				jas_eprintf("error: invalid component number in CMAP box\n");
 				goto error;
@@ -391,7 +392,7 @@ jas_image_t *jp2_decode(jas_stream_t *in, char *optstr)
 
 	/* Mark all components as being of unknown type. */
 
-	for (i = 0; i < JAS_CAST(uint, jas_image_numcmpts(dec->image)); ++i) {
+	for (i = 0; i < JAS_CAST(jas_uint, jas_image_numcmpts(dec->image)); ++i) {
 		jas_image_setcmpttype(dec->image, i, JAS_IMAGE_CT_UNKNOWN);
 	}
 

programming_language: C
filename: jpc_cs.c
change_type: ModificationType.MODIFY
diff: @@ -289,7 +289,7 @@ jpc_ms_t *jpc_getms(jas_stream_t *in, jpc_cstate_t *cstate)
 			jpc_ms_dump(ms, stderr);
 		}
 
-		if (JAS_CAST(ulong, jas_stream_tell(tmpstream)) != ms->len) {
+		if (JAS_CAST(jas_ulong, jas_stream_tell(tmpstream)) != ms->len) {
 			jas_eprintf(
 			  "warning: trailing garbage in marker segment (%ld bytes)\n",
 			  ms->len - jas_stream_tell(tmpstream));
@@ -1177,7 +1177,7 @@ static int jpc_ppm_getparms(jpc_ms_t *ms, jpc_cstate_t *cstate, jas_stream_t *in
 		if (!(ppm->data = jas_malloc(ppm->len))) {
 			goto error;
 		}
-		if (JAS_CAST(uint, jas_stream_read(in, ppm->data, ppm->len)) != ppm->len) {
+		if (JAS_CAST(jas_uint, jas_stream_read(in, ppm->data, ppm->len)) != ppm->len) {
 			goto error;
 		}
 	} else {
@@ -1197,7 +1197,7 @@ static int jpc_ppm_putparms(jpc_ms_t *ms, jpc_cstate_t *cstate, jas_stream_t *ou
 	/* Eliminate compiler warning about unused variables. */
 	cstate = 0;
 
-	if (JAS_CAST(uint, jas_stream_write(out, (char *) ppm->data, ppm->len)) != ppm->len) {
+	if (JAS_CAST(jas_uint, jas_stream_write(out, (char *) ppm->data, ppm->len)) != ppm->len) {
 		return -1;
 	}
 	return 0;

programming_language: C
filename: jpc_cs.h
change_type: ModificationType.MODIFY
diff: @@ -490,7 +490,7 @@ typedef struct {
 	uint_fast16_t len;
 
 	/* The data. */
-	uchar *data;
+	jas_uchar *data;
 
 } jpc_ppm_t;
 
@@ -529,7 +529,7 @@ typedef struct {
 	uint_fast16_t len;
 
 	/* The data. */
-	uchar *data;
+	jas_uchar *data;
 
 } jpc_com_t;
 
@@ -577,7 +577,7 @@ typedef struct {
 typedef struct {
 
 	/* The data. */
-	uchar *data;
+	jas_uchar *data;
 
 	/* The length. */
 	uint_fast16_t len;

programming_language: C
filename: jpc_dec.c
change_type: ModificationType.MODIFY
diff: @@ -2276,7 +2276,7 @@ int jpc_ppxstab_insert(jpc_ppxstab_t *tab, jpc_ppxstabent_t *ent)
 jpc_streamlist_t *jpc_ppmstabtostreams(jpc_ppxstab_t *tab)
 {
 	jpc_streamlist_t *streams;
-	uchar *dataptr;
+	jas_uchar *dataptr;
 	uint_fast32_t datacnt;
 	uint_fast32_t tpcnt;
 	jpc_ppxstabent_t *ent;

programming_language: C
filename: jpc_dec.h
change_type: ModificationType.MODIFY
diff: @@ -99,7 +99,7 @@ typedef struct {
 	uint_fast32_t len;
 
 	/* The data. */
-	uchar *data;
+	jas_uchar *data;
 
 } jpc_ppxstabent_t;
 

programming_language: C
filename: jpc_enc.c
change_type: ModificationType.MODIFY
diff: @@ -961,7 +961,7 @@ startoff = jas_stream_getrwcount(enc->out);
 	com = &enc->mrk->parms.com;
 	com->len = JAS_CAST(uint_fast16_t, strlen(buf));
 	com->regid = JPC_COM_LATIN;
-	if (!(com->data = JAS_CAST(uchar *, jas_strdup(buf)))) {
+	if (!(com->data = JAS_CAST(jas_uchar *, jas_strdup(buf)))) {
 		abort();
 	}
 	if (jpc_putms(enc->out, enc->cstate, enc->mrk)) {

programming_language: C
filename: jpc_mqdec.h
change_type: ModificationType.MODIFY
diff: @@ -109,7 +109,7 @@ typedef struct {
 	jas_stream_t *in;
 
 	/* The last character read. */
-	uchar inbuffer;
+	jas_uchar inbuffer;
 
 	/* The EOF indicator. */
 	int eof;

programming_language: C
filename: jpg_dec.c
change_type: ModificationType.MODIFY
diff: @@ -80,6 +80,14 @@
 * Types.
 \******************************************************************************/
 
+typedef struct {
+	size_t max_samples;
+} jpg_dec_importopts_t;
+
+typedef enum {
+	OPT_MAXSIZE,
+} optid_t;
+
 /* JPEG decoder data sink type. */
 
 typedef struct jpg_dest_s {
@@ -127,19 +135,11 @@ static int jpg_copystreamtofile(FILE *out, jas_stream_t *in);
 static jas_image_t *jpg_mkimage(j_decompress_ptr cinfo);
 
 /******************************************************************************\
-*
+* Option parsing.
 \******************************************************************************/
 
-typedef struct {
-	size_t max_size;
-} jpg_dec_importopts_t;
-
-typedef enum {
-	OPT_MAXSIZE,
-} optid_t;
-
 static jas_taginfo_t decopts[] = {
-	{OPT_MAXSIZE, "max_size"},
+	{OPT_MAXSIZE, "max_samples"},
 	{-1, 0}
 };
 
@@ -147,7 +147,7 @@ static int jpg_dec_parseopts(char *optstr, jpg_dec_importopts_t *opts)
 {
 	jas_tvparser_t *tvp;
 
-	opts->max_size = 0;
+	opts->max_samples = 64 * JAS_MEBI;
 
 	if (!(tvp = jas_tvparser_create(optstr ? optstr : ""))) {
 		return -1;
@@ -157,7 +157,7 @@ static int jpg_dec_parseopts(char *optstr, jpg_dec_importopts_t *opts)
 		switch (jas_taginfo_nonull(jas_taginfos_lookup(decopts,
 		  jas_tvparser_gettag(tvp)))->id) {
 		case OPT_MAXSIZE:
-			opts->max_size = atoi(jas_tvparser_getval(tvp));
+			opts->max_samples = atoi(jas_tvparser_getval(tvp));
 			break;
 		default:
 			jas_eprintf("warning: ignoring invalid option %s\n",
@@ -188,7 +188,9 @@ jas_image_t *jpg_decode(jas_stream_t *in, char *optstr)
 	jas_image_t *image;
 	int ret;
 	jpg_dec_importopts_t opts;
-	size_t size;
+	size_t num_samples;
+
+	JAS_DBGLOG(100, ("jpg_decode(%p, \"%s\")\n", in, optstr));
 
 	if (jpg_dec_parseopts(optstr, &opts)) {
 		goto error;
@@ -236,6 +238,18 @@ jas_image_t *jpg_decode(jas_stream_t *in, char *optstr)
 	  cinfo.image_width, cinfo.image_height, cinfo.num_components)
 	  );
 
+	if (opts.max_samples > 0) {
+		if (!jas_safe_size_mul3(cinfo.image_width, cinfo.image_height,
+		  cinfo.num_components, &num_samples)) {
+			goto error;
+		}
+		if (num_samples > opts.max_samples) {
+			jas_eprintf("image is too large (%zu > %zu)\n", num_samples,
+			  opts.max_samples);
+			goto error;
+		}
+	}
+
 	/* Start the decompressor. */
 	JAS_DBGLOG(10, ("jpeg_start_decompress(%p)\n", &cinfo));
 	ret = jpeg_start_decompress(&cinfo);
@@ -245,18 +259,6 @@ jas_image_t *jpg_decode(jas_stream_t *in, char *optstr)
 	  cinfo.output_width, cinfo.output_height, cinfo.output_components)
 	  );
 
-	if (opts.max_size) {
-		if (!jas_safe_size_mul(cinfo.output_width, cinfo.output_height,
-		  &size) ||
-		  !jas_safe_size_mul(size, cinfo.output_components, &size)) {
-			goto error;
-		}
-		if (size > opts.max_size) {
-			jas_eprintf("image is too large\n");
-			goto error;
-		}
-	}
-
 	/* Create an image object to hold the decoded data. */
 	if (!(image = jpg_mkimage(&cinfo))) {
 		jas_eprintf("jpg_mkimage failed\n");

programming_language: C
filename: jpg_val.c
change_type: ModificationType.MODIFY
diff: @@ -77,7 +77,7 @@
 
 int jpg_validate(jas_stream_t *in)
 {
-	uchar buf[JPG_MAGICLEN];
+	jas_uchar buf[JPG_MAGICLEN];
 	int i;
 	int n;
 

programming_language: C
filename: mif_cod.c
change_type: ModificationType.MODIFY
diff: @@ -370,7 +370,7 @@ error:
 
 int mif_validate(jas_stream_t *in)
 {
-	uchar buf[MIF_MAGICLEN];
+	jas_uchar buf[MIF_MAGICLEN];
 	uint_fast32_t magic;
 	int i;
 	int n;
@@ -462,7 +462,7 @@ static int mif_hdr_growcmpts(mif_hdr_t *hdr, int maxcmpts)
 
 static mif_hdr_t *mif_hdr_get(jas_stream_t *in)
 {
-	uchar magicbuf[MIF_MAGICLEN];
+	jas_uchar magicbuf[MIF_MAGICLEN];
 	char buf[4096];
 	mif_hdr_t *hdr;
 	bool done;

programming_language: C
filename: pgx_dec.c
change_type: ModificationType.MODIFY
diff: @@ -151,7 +151,7 @@ error:
 
 int pgx_validate(jas_stream_t *in)
 {
-	uchar buf[PGX_MAGICLEN];
+	jas_uchar buf[PGX_MAGICLEN];
 	uint_fast32_t magic;
 	int i;
 	int n;
@@ -195,7 +195,7 @@ int pgx_validate(jas_stream_t *in)
 static int pgx_gethdr(jas_stream_t *in, pgx_hdr_t *hdr)
 {
 	int c;
-	uchar buf[2];
+	jas_uchar buf[2];
 
 	if ((c = jas_stream_getc(in)) == EOF) {
 		goto error;

programming_language: C
filename: pnm_dec.c
change_type: ModificationType.MODIFY
diff: @@ -180,7 +180,7 @@ jas_image_t *pnm_decode(jas_stream_t *in, char *opts)
 
 int pnm_validate(jas_stream_t *in)
 {
-	uchar buf[2];
+	jas_uchar buf[2];
 	int i;
 	int n;
 

programming_language: C++
filename: ras_dec.c
change_type: ModificationType.MODIFY
diff: @@ -185,7 +185,7 @@ jas_image_t *ras_decode(jas_stream_t *in, char *optstr)
 
 int ras_validate(jas_stream_t *in)
 {
-	uchar buf[RAS_MAGICLEN];
+	jas_uchar buf[RAS_MAGICLEN];
 	int i;
 	int n;
 	uint_fast32_t magic;

programming_language: C
filename: run_test_1
change_type: ModificationType.MODIFY
diff: @@ -54,23 +54,29 @@ for in_file in "${bad_list[@]}"; do
 	name=$(basename "$in_file")
 	echo "############################################################"
 	case "$name" in
-	2_crashes.bmp|jasper-doublefree-mem_close.jpg)
+	2_crashes.bmp)
+		#jasper-doublefree-mem_close.jpg
 		# The file jasper-doublefree-mem_close.jpg must be skipped
 		# since this test could pass or fail depending on the version of
 		# the JPEG library used (and if it passes it will be VERY SLOW).
+		# Thie file 2_crashes.bmp must be skipped since it will try
+		# to allocate a huge palette which can cause an ASAN failure.
 		echo "Skipping $in_file"
 		continue
 		;;
 	esac
 
 	echo "Input file: $in_file"
+	imginfo_opts=()
+	imginfo_opts+=(--max-samples 100000000)
 	special_asan_options=()
 	special_asan_options+=(exitcode=10)
 	special_asan_options+=(allocator_may_return_null=true)
 	special_asan_options+=(detect_leaks=false)
 	#special_asan_options+=(soft_rss_limit_mb=1024)
 	expected_status=1
-	ASAN_OPTIONS="${special_asan_options[*]}" "$imginfo" < "$in_file"
+	ASAN_OPTIONS="${special_asan_options[*]}" \
+	  "$imginfo" "${imginfo_opts[@]}" < "$in_file"
 	status=$?
 	echo "actual exit status: $status"
 	echo "expected exit status: $expected_status"

programming_language: Shell