+++ /dev/null
---- jasper-1.900.1.orig/src/libjasper/jpc/jpc_cs.c 2007-01-19 22:43:07.000000000 +0100
-+++ jasper-1.900.1/src/libjasper/jpc/jpc_cs.c 2007-04-06 01:29:02.000000000 +0200
-@@ -982,7 +982,10 @@ static int jpc_qcx_getcompparms(jpc_qcxc
- compparms->numstepsizes = (len - n) / 2;
- break;
- }
-- if (compparms->numstepsizes > 0) {
-+ if (compparms->numstepsizes > 3 * JPC_MAXRLVLS + 1) {
-+ jpc_qcx_destroycompparms(compparms);
-+ return -1;
-+ } else if (compparms->numstepsizes > 0) {
- compparms->stepsizes = jas_malloc(compparms->numstepsizes *
- sizeof(uint_fast16_t));
- assert(compparms->stepsizes);