Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
sz += (t & 0x7F) + 1;
pal += ((t & 0x7F) + 1) * 3;
} else if(t & 0x40){ /* copy with offset */
- off = avio_r8(s->pb) * 3;
+ off = avio_r8(s->pb);
j = (t & 0x3F) + 1;
+ if (off + j > 0xff) {
+ av_log(s, AV_LOG_ERROR,
+ "Invalid palette update, offset=%d length=%d extends beyond palette size\n",
+ off, j);
+ return AVERROR_INVALIDDATA;
+ }
+ off *= 3;
while(j-- && sz < 256) {
*pal++ = oldpal[off + 0];
*pal++ = oldpal[off + 1];