Fix a read past end of buffer crash in the mp3 probe
authorAlex Converse <alex.converse@gmail.com>
Tue, 20 Jan 2009 08:00:39 +0000 (08:00 +0000)
committerAlex Converse <alex.converse@gmail.com>
Tue, 20 Jan 2009 08:00:39 +0000 (08:00 +0000)
Originally committed as revision 16693 to svn://svn.ffmpeg.org/ffmpeg/trunk

libavformat/mp3.c

index ec8c0bb997a2ff89047c429535e6db16708e8bb4..eca9ad4240040337864309f3561672481ee5ec2d 100644 (file)
@@ -364,7 +364,7 @@ static int mp3_read_probe(AVProbeData *p)
 
     max_frames = 0;
     buf = buf0;
-    end = buf + p->buf_size - sizeof(uint32_t);
+    end = p->buf + p->buf_size - sizeof(uint32_t);
 
     for(; buf < end; buf= buf2+1) {
         buf2 = buf;