pafdec: fix wrong palette index check.

Fixes Ticket1641 Found-by: Piotr Bandurski <ami_stuff@o2.pl> Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
13 years ago · 456f0c6477
parent 02f12de1c2
commit 456f0c6477
1 changed files with 1 additions and 1 deletions
--- a/libavcodec/paf.c
+++ b/libavcodec/paf.c
@ -276,7 +276,7 @@ static int paf_vid_decode(AVCodecContext *avctx, void *data,
        index = bytestream2_get_byte(&c->gb);
        count = bytestream2_get_byte(&c->gb) + 1;

-        if (index + count > AVPALETTE_SIZE)
+        if (index + count > 256)
            return AVERROR_INVALIDDATA;
        if (bytestream2_get_bytes_left(&c->gb) < 3 * AVPALETTE_SIZE)
            return AVERROR_INVALIDDATA;