From f0896a6bd94e5b45447c7d640c8e8aa95d860d7a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 16 Aug 2012 03:15:14 +0200 Subject: [PATCH] sp5xdec: fix off by 1 error causing a crash Fixes Ticket1633 Found-by: Piotr Bandurski Signed-off-by: Michael Niedermayer --- libavcodec/sp5xdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/sp5xdec.c b/libavcodec/sp5xdec.c index 8715c8db9d..7216088e7f 100644 --- a/libavcodec/sp5xdec.c +++ b/libavcodec/sp5xdec.c @@ -72,7 +72,7 @@ static int sp5x_decode_frame(AVCodecContext *avctx, for (i = 2; i < buf_size-2 && j < buf_size+1024-2; i++) recoded[j++] = buf[i]; else - for (i = 14; i < buf_size && j < buf_size+1024-2; i++) + for (i = 14; i < buf_size && j < buf_size+1024-3; i++) { recoded[j++] = buf[i]; if (buf[i] == 0xff)