Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| ... | ... |
@@ -169,6 +169,8 @@ static int avs_read_packet(AVFormatContext * s, AVPacket * pkt) |
| 169 | 169 |
|
| 170 | 170 |
switch (type) {
|
| 171 | 171 |
case AVS_PALETTE: |
| 172 |
+ if (size - 4 > sizeof(palette)) |
|
| 173 |
+ return AVERROR_INVALIDDATA; |
|
| 172 | 174 |
ret = avio_read(s->pb, palette, size - 4); |
| 173 | 175 |
if (ret < size - 4) |
| 174 | 176 |
return AVERROR(EIO); |