pictordec: fix cga palette index limit
authorMichael Niedermayer <michaelni@gmx.at>
Sun, 10 Feb 2013 17:31:05 +0000 (18:31 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Sun, 10 Feb 2013 17:31:05 +0000 (18:31 +0100)
Fixes out of array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/pictordec.c

index 7c8f7e9..69d2382 100644 (file)
@@ -174,7 +174,7 @@ static int decode_frame(AVCodecContext *avctx,
         npal = FFMIN(esize, 16);
         for (i = 0; i < npal; i++) {
             int pal_idx = bytestream2_get_byte(&s->g);
-            palette[i]  = ff_cga_palette[FFMIN(pal_idx, 16)];
+            palette[i]  = ff_cga_palette[FFMIN(pal_idx, 15)];
         }
     } else if (etype == 3) {
         npal = FFMIN(esize, 16);