X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fdvdsubdec.c;h=e91d63ea295c7d2abd3b8a9a2f5e5fb6e543cb4e;hb=94eb600f354c486fd3a9b50e052e809452673fcf;hp=b81b481e4376b1dde9a8016622868c07357de531;hpb=62c58c59d54fda034ed7f7c16e3faa1bdaa1e16d;p=ffmpeg

diff --git a/libavcodec/dvdsubdec.c b/libavcodec/dvdsubdec.c
index b81b481e437..e91d63ea295 100644
--- a/libavcodec/dvdsubdec.c
+++ b/libavcodec/dvdsubdec.c
@@ -185,7 +185,7 @@ static void guess_palette(DVDSubContext* ctx,
     for(i = 0; i < 4; i++) {
         if (alpha[i] != 0) {
             if (!color_used[colormap[i]])  {
-                level = level_map[nb_opaque_colors][j];
+                level = level_map[nb_opaque_colors - 1][j];
                 r = (((subtitle_color >> 16) & 0xff) * level) >> 8;
                 g = (((subtitle_color >> 8) & 0xff) * level) >> 8;
                 b = (((subtitle_color >> 0) & 0xff) * level) >> 8;
@@ -548,7 +548,8 @@ static int append_to_cached_buf(AVCodecContext *avctx,
 {
     DVDSubContext *ctx = avctx->priv_data;
 
-    if (ctx->buf_size >= sizeof(ctx->buf) - buf_size) {
+    av_assert0(buf_size >= 0 && ctx->buf_size <= sizeof(ctx->buf));
+    if (buf_size >= sizeof(ctx->buf) - ctx->buf_size) {
         av_log(avctx, AV_LOG_WARNING, "Attempt to reconstruct "
                "too large SPU packets aborted.\n");
         ctx->buf_size = 0;