Code:  static int mem_write(jas_stream_obj_t *obj, char *buf, int cnt)
 {
	int n;
 	int ret;
 	jas_stream_memobj_t *m = (jas_stream_memobj_t *)obj;
	long newbufsize;
	long newpos;
 
 	assert(buf);
 	assert(cnt >= 0);

	JAS_DBGLOG(100, ("mem_write(%p, %p, %d)\n", obj, buf, cnt));
	newpos = m->pos_ + cnt;
 	if (newpos > m->bufsize_ && m->growable_) {
 		newbufsize = m->bufsize_;
 		while (newbufsize < newpos) {
			newbufsize <<= 1;
			assert(newbufsize >= 0);
 		}
		JAS_DBGLOG(100, ("mem_write resizing from %d to %z\n", m->bufsize_,
 		  newbufsize));
		JAS_DBGLOG(100, ("mem_write resizing from %d to %ul\n", m->bufsize_,
		  JAS_CAST(unsigned long, newbufsize)));
 		if (mem_resize(m, newbufsize)) {
 			return -1;
 		}
	}
	if (m->pos_ > m->len_) {
		/* The current position is beyond the end of the file, so
		  pad the file to the current position with zeros. */
		n = JAS_MIN(m->pos_, m->bufsize_) - m->len_;
		if (n > 0) {
			memset(&m->buf_[m->len_], 0, n);
			m->len_ += n;
		}
		if (m->pos_ != m->len_) {
			/* The buffer is not big enough. */
			return 0;
		}
	}
	n = m->bufsize_ - m->pos_;
	ret = JAS_MIN(n, cnt);
	if (ret > 0) {
		memcpy(&m->buf_[m->pos_], buf, ret);
		m->pos_ += ret;
	}
	if (m->pos_ > m->len_) {
		m->len_ = m->pos_;
	}
	assert(ret == cnt);
	return ret;
}

Vulnerability Type: DoS Overflow 
CWE ID: CWE-190
Summary: Multiple integer overflows in the (1) jas_realloc function in base/jas_malloc.c and (2) mem_resize function in base/jas_stream.c in JasPer before 1.900.22 allow remote attackers to cause a denial of service via a crafted image, which triggers use after free vulnerabilities.
Commit Message: Made some changes to the I/O stream library for memory streams.
There were a number of potential problems due to the possibility
of integer overflow.
Changed some integral types to the larger types size_t or ssize_t.
For example, the function mem_resize now takes the buffer size parameter
as a size_t.
Added a new function jas_stream_memopen2, which takes a
buffer size specified as a size_t instead of an int.
This can be used in jas_image_cmpt_create to avoid potential
overflow problems.

Added a new function jas_deprecated to warn about reliance on
deprecated library behavior.