Hi, I am writing to report a size_t overflow that I discovered in this project.

1. Vulnerability Summary:

/root/build/jasper-4.2.8/src/libjasper/base/jas_stream.c:713:22: runtime error: unsigned integer overflow: 0 - 1 cannot be represented in type 'size_t' (aka 'unsigned long')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /root/build/jasper-4.2.8/src/libjasper/base/jas_stream.c:713:22 in

2. Affected Version
   The latest release version 4.2.8.

3. Reproduce

• Command line:

jasper "--input" "A" "--output" "B" "--input-format" "pg" "--output-format" "jpc" "" ""

• Compile the executable binary with "--fsanitizer=undefined" flag.
• Corrupted input data A (unzip A.zip first):

A.zip

Best regards,