diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-10-26 00:11:52 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-12-04 20:25:15 +0100 |
| commit | 9ec40eacb1696933b507bf6860d149f0c25494b6 (patch) | |
| tree | 9b99551b5431b82fcc38546a2fadf427ade857e8 | |
| parent | 8cca6b06ec6c47977855aa8282e1cf089ec9a3e6 (diff) | |
| download | ffmpeg-9ec40eacb1696933b507bf6860d149f0c25494b6.tar.gz | |
avcodec/dvdsubdec: Fix off by 1 error
Fixes out of array read
Found-by: Thomas Garnier using libFuzzer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c92f55847a3d9cd12db60bfcd0831ff7f089c37c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/dvdsubdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/dvdsubdec.c b/libavcodec/dvdsubdec.c index 783a24fc1a..4ae63b40ac 100644 --- a/libavcodec/dvdsubdec.c +++ b/libavcodec/dvdsubdec.c @@ -185,7 +185,7 @@ static void guess_palette(DVDSubContext* ctx, for(i = 0; i < 4; i++) { if (alpha[i] != 0) { if (!color_used[colormap[i]]) { - level = level_map[nb_opaque_colors][j]; + level = level_map[nb_opaque_colors - 1][j]; r = (((subtitle_color >> 16) & 0xff) * level) >> 8; g = (((subtitle_color >> 8) & 0xff) * level) >> 8; b = (((subtitle_color >> 0) & 0xff) * level) >> 8; |