Browse code

smacker: fix off-by-one error in palette expanding code

Kostya Shishkov authored on 2013/05/27 13:26:28
Showing 1 changed files
... ...
@@ -274,7 +274,7 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
274 274
                 } else if(t & 0x40){ /* copy with offset */
275 275
                     off = avio_r8(s->pb);
276 276
                     j = (t & 0x3F) + 1;
277
-                    if (off + j > 0xff) {
277
+                    if (off + j > 0x100) {
278 278
                         av_log(s, AV_LOG_ERROR,
279 279
                                "Invalid palette update, offset=%d length=%d extends beyond palette size\n",
280 280
                                off, j);