diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-10-26 00:11:52 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-12-05 18:29:12 +0100 |
| commit | 37ff66d1bde72f7fa89cd5c606d7288fb445852e (patch) | |
| tree | 4db682220c0e5ab62cb67709e8ba0b59c4f4656e | |
| parent | b6b7034416073f65c00a70448d7c24430e1dc594 (diff) | |
| download | ffmpeg-37ff66d1bde72f7fa89cd5c606d7288fb445852e.tar.gz | |
avcodec/dvdsubdec: Fix off by 1 error
Fixes out of array read
Found-by: Thomas Garnier using libFuzzer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c92f55847a3d9cd12db60bfcd0831ff7f089c37c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/dvdsubdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/dvdsubdec.c b/libavcodec/dvdsubdec.c index 783a24fc1a..4ae63b40ac 100644 --- a/libavcodec/dvdsubdec.c +++ b/libavcodec/dvdsubdec.c @@ -185,7 +185,7 @@ static void guess_palette(DVDSubContext* ctx, for(i = 0; i < 4; i++) { if (alpha[i] != 0) { if (!color_used[colormap[i]]) { - level = level_map[nb_opaque_colors][j]; + level = level_map[nb_opaque_colors - 1][j]; r = (((subtitle_color >> 16) & 0xff) * level) >> 8; g = (((subtitle_color >> 8) & 0xff) * level) >> 8; b = (((subtitle_color >> 0) & 0xff) * level) >> 8; |