LibGfx/JPEG2000: Check tile_part_length ("Psot") validity

Author: https://github.com/nico
Commit: 259c3fc7d3
Pull-request: https://github.com/SerenityOS/serenity/pull/23901
Reviewed-by: https://github.com/trflynn89 ✅

Userland/Libraries/LibGfx/ImageFormats/JPEG2000Loader.cpp

@@ -249,6 +249,8 @@ static ErrorOr<void> parse_codestream_tile_header(JPEG2000LoadingContext& contex
         tile_bitstream_length = context.codestream_data.size() - context.codestream_cursor - 2;
     } else {
         u32 tile_header_length = context.codestream_cursor - tile_start;
+        if (start_of_tile.tile_part_length < tile_header_length)
+            return Error::from_string_literal("JPEG2000ImageDecoderPlugin: Invalid tile part length");
         tile_bitstream_length = start_of_tile.tile_part_length - tile_header_length;
     }