From eb2b0bc2a72b497798bd5e327a661ba43786ef7a Mon Sep 17 00:00:00 2001
From: reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2>
Date: Sat, 13 Jan 2007 11:06:40 +0000
Subject: [PATCH] Fix invalid read for gifs with a palette for less than 256
 colors

git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@21899 b3059339-0415-0410-9bf9-f77b7e298cf2
---
 libmpdemux/demux_gif.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libmpdemux/demux_gif.c b/libmpdemux/demux_gif.c
index 829973f3d5..b233ca6e5b 100644
--- a/libmpdemux/demux_gif.c
+++ b/libmpdemux/demux_gif.c
@@ -119,9 +119,11 @@ static int demux_gif_fill_buffer(demuxer_t *demuxer, demux_stream_t *ds)
 
   {
     int y;
+    int cnt = effective_map->ColorCount;
+    if (cnt > 256) cnt = 256;
 
     // copy the palette
-    for (y = 0; y < 256; y++) {
+    for (y = 0; y < cnt; y++) {
 	priv->palette[(y * 4) + 0] = effective_map->Colors[y].Blue;
 	priv->palette[(y * 4) + 1] = effective_map->Colors[y].Green;
 	priv->palette[(y * 4) + 2] = effective_map->Colors[y].Red;