>From a6aedbec43d63e9c5952ae6b7c979984ea253165 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alberto=20Delm=C3=A1s?= <[email protected]> Date: Mon, 3 Sep 2012 17:28:01 +0200 Subject: [PATCH 1/2] mss2: Don't try to read too many palette entries
Reported by Michael Niedermayer <[email protected]> --- libavcodec/mss2.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/libavcodec/mss2.c b/libavcodec/mss2.c index ce3cfb8..9914562 100644 --- a/libavcodec/mss2.c +++ b/libavcodec/mss2.c @@ -161,7 +161,7 @@ static int decode_pal_v2(MSS12Context *ctx, const uint8_t *buf, int buf_size) return 0; ncol = *buf++; - if (buf_size < 2 + ncol * 3) + if (ncol > ctx->free_colours || buf_size < 2 + ncol * 3) return -1; for (i = 0; i < ncol; i++) *pal++ = AV_RB24(buf + 3 * i); -- 1.7.5.1
_______________________________________________ libav-devel mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-devel
