From 2a5a6416a5a95adcab03c2b01162461222649973 Mon Sep 17 00:00:00 2001
From: Antonin Descampe <antonin@gmail.com>
Date: Sat, 16 Apr 2011 12:09:16 +0000
Subject: [PATCH] fixed a bug in mqc.c (see
 https://groups.google.com/d/topic/openjpeg/kQ1PbZUd19k/discussion, credit to
 Peter Wimmer)

---
 CHANGES           | 1 +
 libopenjpeg/mqc.c | 9 ++++-----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/CHANGES b/CHANGES
index fdc94ebe..d524eccd 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,7 @@ What's New for OpenJPEG
 + : added
 
 April 16, 2011
+* [antonin] fixed a bug in mqc.c (see https://groups.google.com/d/topic/openjpeg/kQ1PbZUd19k/discussion, credit to Peter Wimmer)
 * [antonin] fixed wrong path in Doxyfile.dox
 
 April 14, 2011
diff --git a/libopenjpeg/mqc.c b/libopenjpeg/mqc.c
index 5d25238e..14129fbf 100644
--- a/libopenjpeg/mqc.c
+++ b/libopenjpeg/mqc.c
@@ -521,22 +521,21 @@ void mqc_init_dec(opj_mqc_t *mqc, unsigned char *bp, int len) {
 		unsigned int c;
 		unsigned int *ip;
 		unsigned char *end = mqc->end - 1;
-		mqc->buffer = opj_realloc(mqc->buffer, (2 * len + 1) * sizeof(unsigned int));
+		mqc->buffer = opj_realloc(mqc->buffer, (len + 1) * sizeof(unsigned int));
 		ip = (unsigned int *) mqc->buffer;
 
-		while (bp != end) {
+		while (bp < end) {
 			c = *(bp + 1);
 			if (*bp == 0xff) {
 				if (c > 0x8f) {
-					*ip = 0x0000ff18;
+					break;
 				} else {
-					bp++;
 					*ip = 0x00000017 | (c << 9);
 				}
 			} else {
-				bp++;
 				*ip = 0x00000018 | (c << 8);
 			}
+			bp++;
 			ip++;
 		}