avcodec/smvjpegdec: copy palette too
authorMichael Niedermayer <michaelni@gmx.at>
Fri, 7 Jun 2013 23:19:27 +0000 (01:19 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Fri, 7 Jun 2013 23:20:55 +0000 (01:20 +0200)
Fixes out of array access

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/smvjpegdec.c

index 4897575..2086a28 100644 (file)
@@ -70,6 +70,9 @@ static inline void smv_img_pnt(uint8_t *dst_data[4], uint8_t *src_data[4],
         smv_img_pnt_plane(&dst_data[i], src_data[i],
             src_linesizes[i], h, nlines);
     }
+    if (desc->flags & AV_PIX_FMT_FLAG_PAL ||
+        desc->flags & AV_PIX_FMT_FLAG_PSEUDOPAL)
+        dst_data[1] = src_data[1];
 }
 
 static av_cold int smvjpeg_decode_init(AVCodecContext *avctx)