diff options
author | Alberto Delmás <adelmas@gmail.com> | 2012-09-03 17:28:01 +0200 |
---|---|---|
committer | Kostya Shishkov <kostya.shishkov@gmail.com> | 2012-09-06 20:38:22 +0200 |
commit | 6ceef07b21a6b828d98f25edefb66e322a628667 (patch) | |
tree | d950b8218f7603c12bed75111058abc25a80d470 | |
parent | 59383d574046616ede75e51eeb404c9eb8b56d40 (diff) | |
download | ffmpeg-streaming-6ceef07b21a6b828d98f25edefb66e322a628667.zip ffmpeg-streaming-6ceef07b21a6b828d98f25edefb66e322a628667.tar.gz |
mss2: do not try to read too many palette entries
Reported by Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>
-rw-r--r-- | libavcodec/mss2.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/mss2.c b/libavcodec/mss2.c index ce3cfb8..9914562 100644 --- a/libavcodec/mss2.c +++ b/libavcodec/mss2.c @@ -161,7 +161,7 @@ static int decode_pal_v2(MSS12Context *ctx, const uint8_t *buf, int buf_size) return 0; ncol = *buf++; - if (buf_size < 2 + ncol * 3) + if (ncol > ctx->free_colours || buf_size < 2 + ncol * 3) return -1; for (i = 0; i < ncol; i++) *pal++ = AV_RB24(buf + 3 * i); |