Process crash via unchecked tile-part index write

Heap buffer overflow in OpenJPEG's opj_decompress on Red Hat Enterprise Linux 9 allows local users to crash the utility via a crafted image. In opj_j2k_add_tlmarker, current_tpsno indexes the tile-part array for a start_pos write without first checking it against the allocated nb_tps count. Exploitation requires a local user to invoke opj_decompress with the -t option on attacker-controlled JPEG 2000 data; the demonstrated result is an out-of-bounds heap write and process abort.