Reported by Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>
... | ... |
@@ -161,7 +161,7 @@ static int decode_pal_v2(MSS12Context *ctx, const uint8_t *buf, int buf_size) |
161 | 161 |
return 0; |
162 | 162 |
|
163 | 163 |
ncol = *buf++; |
164 |
- if (buf_size < 2 + ncol * 3) |
|
164 |
+ if (ncol > ctx->free_colours || buf_size < 2 + ncol * 3) |
|
165 | 165 |
return -1; |
166 | 166 |
for (i = 0; i < ncol; i++) |
167 | 167 |
*pal++ = AV_RB24(buf + 3 * i); |