From e3100f714c2bae3da26877020048e2cf5906172b Mon Sep 17 00:00:00 2001
From: Aaron Boxer <boxerab@gmail.com>
Date: Thu, 28 Jan 2016 19:34:00 -0500
Subject: [PATCH 1/2] issue #695 MQ Encode: ensure that bp pointer never points
 to uninitialized memory

---
 src/lib/openjp2/mqc.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/src/lib/openjp2/mqc.c b/src/lib/openjp2/mqc.c
index 7e0f5637..e6e4cc87 100644
--- a/src/lib/openjp2/mqc.c
+++ b/src/lib/openjp2/mqc.c
@@ -203,13 +203,14 @@ static opj_mqc_state_t mqc_states[47 * 2] = {
 */
 
 static void opj_mqc_byteout(opj_mqc_t *mqc) {
-	if (*mqc->bp == 0xff) {
+	OPJ_BYTE bp_in_bounds = (mqc->bp >= mqc->start);
+	if (bp_in_bounds & (*mqc->bp == 0xff)) {
 		mqc->bp++;
 		*mqc->bp = (OPJ_BYTE)(mqc->c >> 20);
 		mqc->c &= 0xfffff;
 		mqc->ct = 7;
 	} else {
-		if ((mqc->c & 0x8000000) == 0) {	/* ((mqc->c&0x8000000)==0) CHANGE */
+		if ((bp_in_bounds ^ 1) | ((mqc->c & 0x8000000) == 0)) {	
 			mqc->bp++;
 			*mqc->bp = (OPJ_BYTE)(mqc->c >> 19);
 			mqc->c &= 0x7ffff;
@@ -395,9 +396,6 @@ void opj_mqc_init_enc(opj_mqc_t *mqc, OPJ_BYTE *bp) {
 	mqc->c = 0;
 	mqc->bp = bp - 1;
 	mqc->ct = 12;
-	if (*mqc->bp == 0xff) {
-		mqc->ct = 13;
-	}
 	mqc->start = bp;
 }
 

From 0069a2bd2f8055b7edf9699332f4f00ac5351564 Mon Sep 17 00:00:00 2001
From: Aaron Boxer <boxerab@gmail.com>
Date: Sat, 30 Jan 2016 10:05:46 -0500
Subject: [PATCH 2/2] suppress valgrind error - avoid accessing uninitialized
 memory in mq encoder

---
 src/lib/openjp2/mqc.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/lib/openjp2/mqc.c b/src/lib/openjp2/mqc.c
index e6e4cc87..4e409a7c 100644
--- a/src/lib/openjp2/mqc.c
+++ b/src/lib/openjp2/mqc.c
@@ -203,14 +203,20 @@ static opj_mqc_state_t mqc_states[47 * 2] = {
 */
 
 static void opj_mqc_byteout(opj_mqc_t *mqc) {
-	OPJ_BYTE bp_in_bounds = (mqc->bp >= mqc->start);
-	if (bp_in_bounds & (*mqc->bp == 0xff)) {
+	/* avoid accessing uninitialized memory*/
+	if (mqc->bp == mqc->start-1) {
+		mqc->bp++;
+		*mqc->bp = (OPJ_BYTE)(mqc->c >> 19);
+		mqc->c &= 0x7ffff;
+		mqc->ct = 8;
+	}
+	else if (*mqc->bp == 0xff) {
 		mqc->bp++;
 		*mqc->bp = (OPJ_BYTE)(mqc->c >> 20);
 		mqc->c &= 0xfffff;
 		mqc->ct = 7;
 	} else {
-		if ((bp_in_bounds ^ 1) | ((mqc->c & 0x8000000) == 0)) {	
+		if ((mqc->c & 0x8000000) == 0) {	
 			mqc->bp++;
 			*mqc->bp = (OPJ_BYTE)(mqc->c >> 19);
 			mqc->c &= 0x7ffff;