mirror of
https://gitee.com/openharmony/third_party_ffmpeg
synced 2024-11-27 05:00:37 +00:00
smacker: error out if palette copy-with-offset overruns palette size.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org
This commit is contained in:
parent
a55d5bdc6e
commit
a93b572ae4
@ -265,8 +265,15 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
|
||||
sz += (t & 0x7F) + 1;
|
||||
pal += ((t & 0x7F) + 1) * 3;
|
||||
} else if(t & 0x40){ /* copy with offset */
|
||||
off = avio_r8(s->pb) * 3;
|
||||
off = avio_r8(s->pb);
|
||||
j = (t & 0x3F) + 1;
|
||||
if (off + j > 0xff) {
|
||||
av_log(s, AV_LOG_ERROR,
|
||||
"Invalid palette update, offset=%d length=%d extends beyond palette size\n",
|
||||
off, j);
|
||||
return AVERROR_INVALIDDATA;
|
||||
}
|
||||
off *= 3;
|
||||
while(j-- && sz < 256) {
|
||||
*pal++ = oldpal[off + 0];
|
||||
*pal++ = oldpal[off + 1];
|
||||
|
Loading…
Reference in New Issue
Block a user