[FFmpeg-cvslog] sp5xdec: fix off by 1 error causing a crash

[Michael Niedermayer]

ffmpeg | branch: release/0.11 | Michael Niedermayer <michaelni at gmx.at> | Thu Aug 16 03:15:14 2012 +0200| [450e4b1a60721d25f306d97062f35c9c3d7989f8] | committer: Michael Niedermayer

sp5xdec: fix off by 1 error causing a crash

Fixes Ticket1633

Found-by: Piotr Bandurski <ami_stuff at o2.pl>
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit f0896a6bd94e5b45447c7d640c8e8aa95d860d7a)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=450e4b1a60721d25f306d97062f35c9c3d7989f8
---

 libavcodec/sp5xdec.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/sp5xdec.c b/libavcodec/sp5xdec.c
index 4aca0cc..9a3b3f2 100644
--- a/libavcodec/sp5xdec.c
+++ b/libavcodec/sp5xdec.c
@@ -72,7 +72,7 @@ static int sp5x_decode_frame(AVCodecContext *avctx,
         for (i = 2; i < buf_size-2 && j < buf_size+1024-2; i++)
             recoded[j++] = buf[i];
     else
-    for (i = 14; i < buf_size && j < buf_size+1024-2; i++)
+    for (i = 14; i < buf_size && j < buf_size+1024-3; i++)
     {
         recoded[j++] = buf[i];
         if (buf[i] == 0xff)