X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Frscc.c;h=7b27127bf5318903238f54ad1c37fb30587a5c21;hb=dc8e15ef15d060a9ca118905c770710ce43a0723;hp=bd0520950ff323164344d4a0f73a3ea9f60ff5a6;hpb=9ea6d2149e25d68885a24894bb911077b05388c4;p=ffmpeg

diff --git a/libavcodec/rscc.c b/libavcodec/rscc.c
index bd0520950ff..7b27127bf53 100644
--- a/libavcodec/rscc.c
+++ b/libavcodec/rscc.c
@@ -43,6 +43,7 @@
 
 #include "avcodec.h"
 #include "bytestream.h"
+#include "decode.h"
 #include "internal.h"
 
 #define TILE_SIZE 8
@@ -300,6 +301,10 @@ static int rscc_decode_frame(AVCodecContext *avctx, void *data,
             ret = AVERROR_INVALIDDATA;
             goto end;
         }
+        if (ctx->inflated_size < pixel_size) {
+            ret = AVERROR_INVALIDDATA;
+            goto end;
+        }
         ret = uncompress(ctx->inflated_buf, &len, gbc->buffer, packed_size);
         if (ret) {
             av_log(avctx, AV_LOG_ERROR, "Pixel deflate error %d.\n", ret);
@@ -342,17 +347,8 @@ static int rscc_decode_frame(AVCodecContext *avctx, void *data,
 
     /* Palette handling */
     if (avctx->pix_fmt == AV_PIX_FMT_PAL8) {
-        int size;
-        const uint8_t *palette = av_packet_get_side_data(avpkt,
-                                                         AV_PKT_DATA_PALETTE,
-                                                         &size);
-        if (palette && size == AVPALETTE_SIZE) {
-            frame->palette_has_changed = 1;
-            memcpy(ctx->palette, palette, AVPALETTE_SIZE);
-        } else if (palette) {
-            av_log(avctx, AV_LOG_ERROR, "Palette size %d is wrong\n", size);
-        }
-        memcpy (frame->data[1], ctx->palette, AVPALETTE_SIZE);
+        frame->palette_has_changed = ff_copy_palette(ctx->palette, avpkt, avctx);
+        memcpy(frame->data[1], ctx->palette, AVPALETTE_SIZE);
     }
     // We only return a picture when enough of it is undamaged, this avoids copying nearly broken frames around
     if (ctx->valid_pixels < ctx->inflated_size)