diff options
| author | reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2007-01-13 11:06:40 +0000 |
|---|---|---|
| committer | reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2007-01-13 11:06:40 +0000 |
| commit | eb2b0bc2a72b497798bd5e327a661ba43786ef7a (patch) | |
| tree | 19a0c55f73917d4f3ec21ce9af6c3045487c9535 /libmpdemux | |
| parent | 6a2c85c59cda3987f7b83591a561c9908337c2ff (diff) | |
| download | mpv-eb2b0bc2a72b497798bd5e327a661ba43786ef7a.tar.bz2 mpv-eb2b0bc2a72b497798bd5e327a661ba43786ef7a.tar.xz | |
Fix invalid read for gifs with a palette for less than 256 colors
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@21899 b3059339-0415-0410-9bf9-f77b7e298cf2
Diffstat (limited to 'libmpdemux')
| -rw-r--r-- | libmpdemux/demux_gif.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libmpdemux/demux_gif.c b/libmpdemux/demux_gif.c index 829973f3d5..b233ca6e5b 100644 --- a/libmpdemux/demux_gif.c +++ b/libmpdemux/demux_gif.c @@ -119,9 +119,11 @@ static int demux_gif_fill_buffer(demuxer_t *demuxer, demux_stream_t *ds) { int y; + int cnt = effective_map->ColorCount; + if (cnt > 256) cnt = 256; // copy the palette - for (y = 0; y < 256; y++) { + for (y = 0; y < cnt; y++) { priv->palette[(y * 4) + 0] = effective_map->Colors[y].Blue; priv->palette[(y * 4) + 1] = effective_map->Colors[y].Green; priv->palette[(y * 4) + 2] = effective_map->Colors[y].Red; |