oma: dont over-read buffer

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

diff --git a/libavformat/omadec.c b/libavformat/omadec.c
index a62b560504f30a86ce742faaf1be83cf2a698f78..4777c13048adfabd3b33b42982f4d739fb9d89a6 100644 (file)
--- a/libavformat/omadec.c
+++ b/libavformat/omadec.c
@@ -377,7 +377,7 @@ static int oma_read_packet(AVFormatContext *s, AVPacket *pkt)
 
     if (oc->encrypted) {
         /* previous unencrypted block saved in IV for the next packet (CBC mode) */
-        av_des_crypt(&oc->av_des, pkt->data, pkt->data, (packet_size >> 3), oc->iv, 1);
+        av_des_crypt(&oc->av_des, pkt->data, pkt->data, (ret >> 3), oc->iv, 1);
     }
 
     return ret;