From c3c08baefbf8c9b19c9c1f1bd7a899b697422eea Mon Sep 17 00:00:00 2001 From: Kostya Shishkov Date: Mon, 27 May 2013 06:26:28 +0200 Subject: smacker: fix off-by-one error in palette expanding code --- libavformat/smacker.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'libavformat/smacker.c') diff --git a/libavformat/smacker.c b/libavformat/smacker.c index 17c7c529e7..e14424323e 100644 --- a/libavformat/smacker.c +++ b/libavformat/smacker.c @@ -274,7 +274,7 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt) } else if(t & 0x40){ /* copy with offset */ off = avio_r8(s->pb); j = (t & 0x3F) + 1; - if (off + j > 0xff) { + if (off + j > 0x100) { av_log(s, AV_LOG_ERROR, "Invalid palette update, offset=%d length=%d extends beyond palette size\n", off, j); -- cgit v1.2.3