diff options
Diffstat (limited to 'libavformat/smacker.c')
| -rw-r--r-- | libavformat/smacker.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/libavformat/smacker.c b/libavformat/smacker.c index adc67e727e..0b790b82ae 100644 --- a/libavformat/smacker.c +++ b/libavformat/smacker.c @@ -265,8 +265,15 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt) sz += (t & 0x7F) + 1; pal += ((t & 0x7F) + 1) * 3; } else if(t & 0x40){ /* copy with offset */ - off = avio_r8(s->pb) * 3; + off = avio_r8(s->pb); j = (t & 0x3F) + 1; + if (off + j > 0xff) { + av_log(s, AV_LOG_ERROR, + "Invalid palette update, offset=%d length=%d extends beyond palette size\n", + off, j); + return AVERROR_INVALIDDATA; + } + off *= 3; while(j-- && sz < 256) { *pal++ = oldpal[off + 0]; *pal++ = oldpal[off + 1]; |