From: Kostya Shishkov <kostya.shishkov@gmail.com>
Date: Thu, 27 Jun 2024 16:11:19 +0000 (+0200)
Subject: avi: fix handling of multiple palette changes in single 'pc' chunk
X-Git-Url: https://git.nihav.org/?a=commitdiff_plain;h=eea05a77c2b998c94087825a60d1a9f0f4fe2b7d;p=nihav.git

avi: fix handling of multiple palette changes in single 'pc' chunk
---

diff --git a/nihav-commonfmt/src/demuxers/avi.rs b/nihav-commonfmt/src/demuxers/avi.rs
index d29ff45..113f9e0 100644
--- a/nihav-commonfmt/src/demuxers/avi.rs
+++ b/nihav-commonfmt/src/demuxers/avi.rs
@@ -427,19 +427,25 @@ impl<'a> AVIDemuxer<'a> {
     fn parse_palette_change(&mut self, stream_no: usize, size: usize) -> DemuxerResult<()> {
         for pe in self.pal.iter_mut() {
             if pe.stream_no == stream_no {
-                let start_clr           = self.src.read_byte()? as usize;
-                let len                 = self.src.read_byte()? as usize;
-                let len = if len == 0 { 256 } else { len };
-                let _flags              = self.src.read_u16le()?;
-                validate!(start_clr + len <= 256);
-                validate!(len * 4 + 4 == size);
                 let mut newpal = *pe.pal;
-                for i in start_clr..(start_clr + len) {
-                    newpal[i * 4]       = self.src.read_byte()?;
-                    newpal[i * 4 + 1]   = self.src.read_byte()?;
-                    newpal[i * 4 + 2]   = self.src.read_byte()?;
-                    newpal[i * 4 + 3]   = 0;
+                let mut data_left = size;
+                while data_left > 0 {
+                    validate!(data_left >= 8);
+                    let start_clr       = self.src.read_byte()? as usize;
+                    let len             = self.src.read_byte()? as usize;
+                    let len = if len == 0 { 256 } else { len };
+                    let _flags          = self.src.read_u16le()?;
+                    validate!(start_clr + len <= 256);
+                    let change_size = len * 4 + 4;
+                    validate!(change_size <= data_left);
+                    for i in start_clr..(start_clr + len) {
+                        newpal[i * 4]       = self.src.read_byte()?;
+                        newpal[i * 4 + 1]   = self.src.read_byte()?;
+                        newpal[i * 4 + 2]   = self.src.read_byte()?;
+                        newpal[i * 4 + 3]   = 0;
                                           self.src.read_byte()?; // flags
+                    }
+                    data_left -= change_size;
                 }
                 pe.pal = Arc::new(newpal);
                 pe.changed = true;