* simple fix to avoid memcpy with len < 0

Originally committed as revision 180 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavcodec/mpegaudiodec.c b/libavcodec/mpegaudiodec.c
index ca610d65efc228078d258235e03fd0a423c2ef32..80a145b82f8d8f62d28374a0729d92c4ad0e08d1 100644 (file)
--- a/libavcodec/mpegaudiodec.c
+++ b/libavcodec/mpegaudiodec.c
@@ -2268,11 +2268,13 @@ static int decode_frame(AVCodecContext * avctx,
            len = HEADER_SIZE - len;
            if (len > buf_size)
                len = buf_size;
+           else if (len > 0) {
            memcpy(s->inbuf_ptr, buf_ptr, len);
            buf_ptr += len;
-           s->inbuf_ptr += len;
            buf_size -= len;
-           if ((s->inbuf_ptr - s->inbuf) == HEADER_SIZE) {
+               s->inbuf_ptr += len;
+           }
+           if ((s->inbuf_ptr - s->inbuf) >= HEADER_SIZE) {
             got_header:
                header = (s->inbuf[0] << 24) | (s->inbuf[1] << 16) |
                    (s->inbuf[2] << 8) | s->inbuf[3];