From e3c26705392e462fabf54366fbad3dbf6ec832d1 Mon Sep 17 00:00:00 2001 From: Paul B Mahol Date: Mon, 25 Jun 2012 22:45:08 +0000 Subject: [PATCH] mss1: check number of free colours Prevents out of array write. Signed-off-by: Paul B Mahol --- libavcodec/mss1.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/mss1.c b/libavcodec/mss1.c index b9e32331ab..dfddbd97ec 100644 --- a/libavcodec/mss1.c +++ b/libavcodec/mss1.c @@ -783,6 +783,10 @@ static av_cold int mss1_decode_init(AVCodecContext *avctx) av_log(avctx, AV_LOG_DEBUG, "Encoder version %d.%d\n", AV_RB32(avctx->extradata + 4), AV_RB32(avctx->extradata + 8)); c->free_colours = AV_RB32(avctx->extradata + 48); + if (c->free_colours < 0 || c->free_colours > 256) { + av_log(avctx, AV_LOG_ERROR, "Invalid free colours %d\n", c->free_colours); + return AVERROR_INVALIDDATA; + } av_log(avctx, AV_LOG_DEBUG, "%d free colour(s)\n", c->free_colours); avctx->coded_width = AV_RB32(avctx->extradata + 20); avctx->coded_height = AV_RB32(avctx->extradata + 24);