Buffer for get_bits must be padded because readers may overread.

Originally committed as revision 7477 to svn://svn.ffmpeg.org/ffmpeg/trunk

1 files changed, 1 insertions, 1 deletions

diff --git a/libavcodec/mpc.c b/libavcodec/mpc.c
index df009f4876..a500479c0e 100644
--- a/libavcodec/mpc.c
+++ b/libavcodec/mpc.c
@@ -231,7 +231,7 @@ static int mpc7_decode_frame(AVCodecContext * avctx,
         av_log(avctx, AV_LOG_ERROR, "Too small buffer passed (%i bytes)\n", buf_size);
     }
 
-    bits = av_malloc((buf_size - 1) & ~3);
+    bits = av_malloc(((buf_size - 1) & ~3) + FF_INPUT_BUFFER_PADDING_SIZE);
     c->dsp.bswap_buf(bits, buf + 4, (buf_size - 4) >> 2);
     init_get_bits(&gb, bits, (buf_size - 4)* 8);
     skip_bits(&gb, buf[0]);