avcodec/dvdsubdec: Fix off by 1 error
authorMichael Niedermayer <michael@niedermayer.cc>
Tue, 25 Oct 2016 22:11:52 +0000 (00:11 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Wed, 26 Oct 2016 17:50:53 +0000 (19:50 +0200)
Fixes out of array read

Found-by: Thomas Garnier using libFuzzer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/dvdsubdec.c

index 6cb612b..e91d63e 100644 (file)
@@ -185,7 +185,7 @@ static void guess_palette(DVDSubContext* ctx,
     for(i = 0; i < 4; i++) {
         if (alpha[i] != 0) {
             if (!color_used[colormap[i]])  {
-                level = level_map[nb_opaque_colors][j];
+                level = level_map[nb_opaque_colors - 1][j];
                 r = (((subtitle_color >> 16) & 0xff) * level) >> 8;
                 g = (((subtitle_color >> 8) & 0xff) * level) >> 8;
                 b = (((subtitle_color >> 0) & 0xff) * level) >> 8;