smc: Fix overread.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
263bb6edcf
commit
1007a805a4
@ -313,7 +313,7 @@ static void smc_decode_stream(SmcContext *s)
|
|||||||
} else
|
} else
|
||||||
color_table_index = CQUAD * s->buf[stream_ptr++];
|
color_table_index = CQUAD * s->buf[stream_ptr++];
|
||||||
|
|
||||||
while (n_blocks--) {
|
while (n_blocks-- && stream_ptr + 3 < s->size) {
|
||||||
color_flags = AV_RB32(&s->buf[stream_ptr]);
|
color_flags = AV_RB32(&s->buf[stream_ptr]);
|
||||||
stream_ptr += 4;
|
stream_ptr += 4;
|
||||||
/* flag mask actually acts as a bit shift count here */
|
/* flag mask actually acts as a bit shift count here */
|
||||||
|
Loading…
x
Reference in New Issue
Block a user