…canline

A fuzzed JPEG2000 caused a heap-buffer-overflow (caught by ASan) under
`iinfo -stats`: copy_scanline read past the end of openjpeg's decoded
component buffer.

Root cause: the file's image canvas is 32x32, but one of its three
components reports a horizontal subsampling factor dx=249 (a step larger
than the entire image). OIIO derives the ImageSpec size from the union of
each component's x0+w*dx / y0+h*dy window, so that bogus component
inflated the spec to 249x32. copy_scanline then iterated x over the
inflated width while indexing a component whose data array only held
1 column, walking off the end. The per-sample guard was also broken: it
compared the component row index against reference-grid offsets (wrong
units) and used `>` instead of `>=` on the column.

Two fixes:

1. Detect the corruption at open(): the JPEG2000 canvas (x1-x0, y1-y0)
   is the authoritative image size, and a component's subsampling factor
   must be nonzero and no larger than the canvas. Reject files that
   violate this instead of decoding a nonsensical, inflated image.

2. Harden copy_scanline as defense in depth: bounds-check each access
   against the actual component array geometry -- row in [0, comp.h) and
   column in [0, comp.w) -- and skip the channel (zero-fill) when
   comp.data is null or a subsampling factor is zero, which also closes a
   latent divide-by-zero on comp.dx/comp.dy.

Verified that the openjpeg conformance suite (jpeg2000-j2kp4files), which
includes chroma-subsampled images, still decodes correctly.

Assisted-by: Claude Code / Claude Opus 4.8

Signed-off-by: Larry Gritz <lg@larrygritz.com>