sp5xdec: fix off by 1 error causing a crash

Fixes Ticket1633 Found-by: Piotr Bandurski <ami_stuff@o2.pl> Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
13 years ago · f0896a6bd9
parent 747774ece9
commit f0896a6bd9
1 changed files with 1 additions and 1 deletions
--- a/libavcodec/sp5xdec.c
+++ b/libavcodec/sp5xdec.c
@ -72,7 +72,7 @@ static int sp5x_decode_frame(AVCodecContext *avctx,
        for (i = 2; i < buf_size-2 && j < buf_size+1024-2; i++)
            recoded[j++] = buf[i];
    else
-    for (i = 14; i < buf_size && j < buf_size+1024-2; i++)
+    for (i = 14; i < buf_size && j < buf_size+1024-3; i++)
    {
        recoded[j++] = buf[i];
        if (buf[i] == 0xff)