mirror of https://git.ffmpeg.org/ffmpeg.git
avcodec/msrle: Check side data size before use
Fixes out of array read Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
21b68cdbae
commit
a6330119a0
|
@ -99,11 +99,14 @@ static int msrle_decode_frame(AVCodecContext *avctx,
|
||||||
return ret;
|
return ret;
|
||||||
|
|
||||||
if (avctx->bits_per_coded_sample > 1 && avctx->bits_per_coded_sample <= 8) {
|
if (avctx->bits_per_coded_sample > 1 && avctx->bits_per_coded_sample <= 8) {
|
||||||
const uint8_t *pal = av_packet_get_side_data(avpkt, AV_PKT_DATA_PALETTE, NULL);
|
int size;
|
||||||
|
const uint8_t *pal = av_packet_get_side_data(avpkt, AV_PKT_DATA_PALETTE, &size);
|
||||||
|
|
||||||
if (pal) {
|
if (pal && size == AVPALETTE_SIZE) {
|
||||||
s->frame->palette_has_changed = 1;
|
s->frame->palette_has_changed = 1;
|
||||||
memcpy(s->pal, pal, AVPALETTE_SIZE);
|
memcpy(s->pal, pal, AVPALETTE_SIZE);
|
||||||
|
} else if (pal) {
|
||||||
|
av_log(avctx, AV_LOG_ERROR, "Palette size %d is wrong\n", size);
|
||||||
}
|
}
|
||||||
/* make the palette available */
|
/* make the palette available */
|
||||||
memcpy(s->frame->data[1], s->pal, AVPALETTE_SIZE);
|
memcpy(s->frame->data[1], s->pal, AVPALETTE_SIZE);
|
||||||
|
|
Loading…
Reference in New Issue