diff options
| author | Alberto Delmás <adelmas@gmail.com> | 2012-09-03 17:28:01 +0200 |
|---|---|---|
| committer | Kostya Shishkov <kostya.shishkov@gmail.com> | 2012-09-06 20:38:22 +0200 |
| commit | 6ceef07b21a6b828d98f25edefb66e322a628667 (patch) | |
| tree | d950b8218f7603c12bed75111058abc25a80d470 /libavcodec/mss2.c | |
| parent | 59383d574046616ede75e51eeb404c9eb8b56d40 (diff) | |
mss2: do not try to read too many palette entries
Reported by Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>
Diffstat (limited to 'libavcodec/mss2.c')
| -rw-r--r-- | libavcodec/mss2.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/mss2.c b/libavcodec/mss2.c index ce3cfb8a7a..9914562da6 100644 --- a/libavcodec/mss2.c +++ b/libavcodec/mss2.c @@ -161,7 +161,7 @@ static int decode_pal_v2(MSS12Context *ctx, const uint8_t *buf, int buf_size) return 0; ncol = *buf++; - if (buf_size < 2 + ncol * 3) + if (ncol > ctx->free_colours || buf_size < 2 + ncol * 3) return -1; for (i = 0; i < ncol; i++) *pal++ = AV_RB24(buf + 3 * i); |