[FFmpeg-cvslog] r20007 - trunk/libavcodec/bmp.c

[kostya]

Author: kostya
Date: Thu Sep 24 07:24:46 2009
New Revision: 20007

Log:
Take into account real number of colours when reading BMP palette.
This fixes issue 1408

Modified:
   trunk/libavcodec/bmp.c

Modified: trunk/libavcodec/bmp.c
==============================================================================
--- trunk/libavcodec/bmp.c	Wed Sep 23 20:22:00 2009	(r20006)
+++ trunk/libavcodec/bmp.c	Thu Sep 24 07:24:46 2009	(r20007)
@@ -231,12 +231,23 @@ static int bmp_decode_frame(AVCodecConte
     }
 
     if(avctx->pix_fmt == PIX_FMT_PAL8){
+        int colors = 1 << depth;
+        if(ihsize >= 36){
+            int t;
+            buf = buf0 + 46;
+            t = bytestream_get_le32(&buf);
+            if(t < 0 || t > (1 << depth)){
+                av_log(avctx, AV_LOG_ERROR, "Incorrect number of colors - %X for bitdepth %d\n", t, depth);
+            }else if(t){
+                colors = t;
+            }
+        }
         buf = buf0 + 14 + ihsize; //palette location
-        if((hsize-ihsize-14)>>depth < 4){ // OS/2 bitmap, 3 bytes per palette entry
-            for(i = 0; i < (1 << depth); i++)
+        if((hsize-ihsize-14) < (colors << 2)){ // OS/2 bitmap, 3 bytes per palette entry
+            for(i = 0; i < colors; i++)
                 ((uint32_t*)p->data[1])[i] = bytestream_get_le24(&buf);
         }else{
-            for(i = 0; i < (1 << depth); i++)
+            for(i = 0; i < colors; i++)
                 ((uint32_t*)p->data[1])[i] = bytestream_get_le32(&buf);
         }
         buf = buf0 + hsize;