@@ -265,8 +265,15 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)

                     sz += (t & 0x7F) + 1;

                     pal += ((t & 0x7F) + 1) * 3;

                 } else if(t & 0x40){ /* copy with offset */

-                    off = avio_r8(s->pb) * 3;

+                    off = avio_r8(s->pb);

                     j = (t & 0x3F) + 1;

+                    if (off + j > 0xff) {

+                        av_log(s, AV_LOG_ERROR,

+                               "Invalid palette update, offset=%d length=%d extends beyond palette size\n",

+                               off, j);

+                        return AVERROR_INVALIDDATA;

+                    }

+                    off *= 3;

                     while(j-- && sz < 256) {

                         *pal++ = oldpal[off + 0];

                         *pal++ = oldpal[off + 1];