fix(jpeg2000): guard the HTJ2K reader, not just the OpenJPEG one

[lgritz]

This plugin has two reader codepaths, one using OpenJPEG and the other using HTJ2K. Earlier bomb-header guards only covered the OpenJPEG path. The HTJ2K's open() function read width and height straight from the header and then allocated the full image before any check ran. The HTJ2K path now runs the same size checks as the OpenJPEG path before it sizes anything from the header.

Error handling on this path was also broken. A failed read logged an error but did not stop; the code kept going and used image data that was never filled in. This happened in two decode loops, and also when the codestream failed to open. One buffer resize sat outside its own error check. The read function could then return success after logging failure, so callers copied scanlines out of an empty buffer. Each of these paths now stops on error, and the scanline copy is bounds-checked.

Two more small fixes: a file with zero color components used to read past the end of an internal array, so that case is now rejected. And one error path in ICC strict mode used to skip closing the file; it now closes it like every other failure path.

Assisted-by: Claude Code / claude-opus-5

[Copilot]

Pull request overview

This PR hardens the JPEG2000 plugin’s HTJ2K (OpenJPH) reader path to match the existing OpenJPEG safeguards, preventing decompression-bomb headers from triggering huge allocations, and fixes multiple error-handling paths so failed decodes cannot be treated as successful reads.

Changes:

• Add check_open() + check_compression_ratio() validation to the HTJ2K header path before any full-image allocation.
• Make HTJ2K decode failures propagate correctly (stop on errors) and bounds-check scanline copies from the decoded buffer.
• Extend the htj2k testsuite with malformed codestream fixtures and reference output that verifies rejection messages.

Reviewed changes

Copilot reviewed 4 out of 7 changed files in this pull request and generated no comments.

File	Description
src/jpeg2000.imageio/jpeg2000input.cpp	Adds header-time size vetting for HTJ2K, fixes error propagation in OpenJPH decode loops, and adds scanline copy bounds checks.
testsuite/htj2k/src/make_malformed_htj2k.py	New generator script for committed malformed HTJ2K fixtures (bomb-resolution / bomb-ratio).
testsuite/htj2k/run.py	Captures stderr and adds test invocations that verify malformed HTJ2K headers are rejected at open/read time.
testsuite/htj2k/ref/out.txt	Updates golden output to include expected rejection/error messages and a valid-file read/hash.

Suppressed comments (1)

src/jpeg2000.imageio/jpeg2000input.cpp:367

• The HTJ2K (OpenJPH) path treats 32-bit component precision as supported (sets dtype=UINT and bytes-per-sample=4), but ojph_read_image() only populates the buffer for UINT8 and UINT16. For 32-bit codestreams this will return true with m_buf left uninitialized, and read_native_scanline() will memcpy garbage to callers.

        case 32:
            m_bpp[c] = 4;
            dtype    = TypeDesc::UINT;
            break;

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[lgritz]

10 days old. Any objections?