buf += 16;
for (i=pal_start; i<pal_start+pal_count && i<AVPALETTE_COUNT && buf_end - buf >= 3; i++) {
- s->palette[i] = AV_RB24(buf);
+ s->palette[i] = 0xFF << 24 | AV_RB24(buf);
buf += 3;
}
}
return AVERROR_INVALIDDATA;
if (AV_RL32(buf)==MVIh_TAG||AV_RB32(buf)==MVIh_TAG) {
+ unsigned size = AV_RL32(buf + 4);
cmv_process_header(s, buf+EA_PREAMBLE_SIZE, buf_end);
- return buf_size;
+ if (size > buf_end - buf - EA_PREAMBLE_SIZE)
+ return -1;
+ buf += size;
}
if (av_image_check_size(s->width, s->height, 0, s->avctx))
FFSWAP(AVFrame, s->frame, s->last_frame);
s->frame.reference = 3;
- s->frame.buffer_hints = FF_BUFFER_HINTS_VALID;
+ s->frame.buffer_hints = FF_BUFFER_HINTS_VALID |
+ FF_BUFFER_HINTS_READABLE |
+ FF_BUFFER_HINTS_PRESERVE;
if (avctx->get_buffer(avctx, &s->frame)<0) {
av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
return -1;