diff options
| author | Kostya Shishkov <kostya.shishkov@gmail.com> | 2012-06-27 10:11:19 +0200 |
|---|---|---|
| committer | Kostya Shishkov <kostya.shishkov@gmail.com> | 2012-06-27 18:05:58 +0200 |
| commit | 15358ade152ebc28fcc824e09ad9206597c281df (patch) | |
| tree | 256df27d7df9c1583d3d610f64e4f10155b4ff9c | |
| parent | 8f5d573a83d16ed26a71be995cbb886fb743a482 (diff) | |
| download | ffmpeg-15358ade152ebc28fcc824e09ad9206597c281df.tar.gz | |
mss1: validate number of changeable palette entries
| -rw-r--r-- | libavcodec/mss1.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavcodec/mss1.c b/libavcodec/mss1.c index 062cf3a7a5..523a9616bf 100644 --- a/libavcodec/mss1.c +++ b/libavcodec/mss1.c @@ -783,6 +783,12 @@ static av_cold int mss1_decode_init(AVCodecContext *avctx) av_log(avctx, AV_LOG_DEBUG, "Encoder version %d.%d\n", AV_RB32(avctx->extradata + 4), AV_RB32(avctx->extradata + 8)); c->free_colours = AV_RB32(avctx->extradata + 48); + if ((unsigned)c->free_colours > 256) { + av_log(avctx, AV_LOG_ERROR, + "Incorrect number of changeable palette entries: %d\n", + c->free_colours); + return AVERROR_INVALIDDATA; + } av_log(avctx, AV_LOG_DEBUG, "%d free colour(s)\n", c->free_colours); avctx->coded_width = AV_RB32(avctx->extradata + 20); avctx->coded_height = AV_RB32(avctx->extradata + 24); |