smacker: fix off by one error
authorPaul B Mahol <onemda@gmail.com>
Wed, 3 Apr 2013 12:57:58 +0000 (12:57 +0000)
committerPaul B Mahol <onemda@gmail.com>
Wed, 3 Apr 2013 13:01:38 +0000 (13:01 +0000)
Regression since a93b572ae4f517ce0c35cf085167c318e9215908.

Fixes #2426.

Signed-off-by: Paul B Mahol <onemda@gmail.com>
libavformat/smacker.c

index 883a2b7..84481e2 100644 (file)
@@ -276,7 +276,7 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
                 } else if(t & 0x40){ /* copy with offset */
                     off = avio_r8(s->pb);
                     j = (t & 0x3F) + 1;
-                    if (off + j > 0xff) {
+                    if (off + j - 1 > 0xff) {
                         av_log(s, AV_LOG_ERROR,
                                "Invalid palette update, offset=%d length=%d extends beyond palette size\n",
                                off, j);