sp5xdec: fix off by 1 error causing a crash

[ffmpeg] / libavcodec / sp5xdec.c

diff --git a/libavcodec/sp5xdec.c b/libavcodec/sp5xdec.c
index 8715c8db9de113d56af1c82c30b9f5a222b813cb..7216088e7fea1daad8b97cb13a2369b5e8c3c757 100644 (file)
--- a/libavcodec/sp5xdec.c
+++ b/libavcodec/sp5xdec.c
@@ -72,7 +72,7 @@ static int sp5x_decode_frame(AVCodecContext *avctx,
         for (i = 2; i < buf_size-2 && j < buf_size+1024-2; i++)
             recoded[j++] = buf[i];
     else
-    for (i = 14; i < buf_size && j < buf_size+1024-2; i++)
+    for (i = 14; i < buf_size && j < buf_size+1024-3; i++)
     {
         recoded[j++] = buf[i];
         if (buf[i] == 0xff)