diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-10-26 00:11:52 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-08-23 13:15:16 +0200 |
| commit | acd2c3842c7f79d4b6561b095f377968f4772d6d (patch) | |
| tree | aee39de6819a971b7eb08a2bd1552167465d978e | |
| parent | 1869ba95f6d745cc69595aab83af9be8d2f2ce9b (diff) | |
| download | ffmpeg-acd2c3842c7f79d4b6561b095f377968f4772d6d.tar.gz | |
avcodec/dvdsubdec: Fix off by 1 error
Fixes out of array read
Found-by: Thomas Garnier using libFuzzer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c92f55847a3d9cd12db60bfcd0831ff7f089c37c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/dvdsubdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/dvdsubdec.c b/libavcodec/dvdsubdec.c index 9e793d73b2..8d631cf731 100644 --- a/libavcodec/dvdsubdec.c +++ b/libavcodec/dvdsubdec.c @@ -182,7 +182,7 @@ static void guess_palette(DVDSubContext* ctx, for(i = 0; i < 4; i++) { if (alpha[i] != 0) { if (!color_used[colormap[i]]) { - level = level_map[nb_opaque_colors][j]; + level = level_map[nb_opaque_colors - 1][j]; r = (((subtitle_color >> 16) & 0xff) * level) >> 8; g = (((subtitle_color >> 8) & 0xff) * level) >> 8; b = (((subtitle_color >> 0) & 0xff) * level) >> 8; |