From 8c5140df2b53e3d4ff02aa607ce41abd64d204d8 Mon Sep 17 00:00:00 2001 From: Paul B Mahol Date: Wed, 3 Apr 2013 12:57:58 +0000 Subject: [PATCH] smacker: fix off by one error Regression since a93b572ae4f517ce0c35cf085167c318e9215908. Fixes #2426. Signed-off-by: Paul B Mahol (cherry picked from commit e3cc92a623a6ece42816c7a692c8815688a99ab0) --- libavformat/smacker.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/smacker.c b/libavformat/smacker.c index 80e2fa694e..b2c442e2d8 100644 --- a/libavformat/smacker.c +++ b/libavformat/smacker.c @@ -263,7 +263,7 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt) } else if(t & 0x40){ /* copy with offset */ off = avio_r8(s->pb); j = (t & 0x3F) + 1; - if (off + j > 0xff) { + if (off + j - 1 > 0xff) { av_log(s, AV_LOG_ERROR, "Invalid palette update, offset=%d length=%d extends beyond palette size\n", off, j);