From 38cef584048b90d2405fdbb8b79a731535948d27 Mon Sep 17 00:00:00 2001
From: Alex Converse <alex.converse@gmail.com>
Date: Tue, 20 Jan 2009 08:00:39 +0000
Subject: Fix a read past end of buffer crash in the mp3 probe

Originally committed as revision 16693 to svn://svn.ffmpeg.org/ffmpeg/trunk
---
 libavformat/mp3.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'libavformat/mp3.c')

diff --git a/libavformat/mp3.c b/libavformat/mp3.c
index ec8c0bb997..eca9ad4240 100644
--- a/libavformat/mp3.c
+++ b/libavformat/mp3.c
@@ -364,7 +364,7 @@ static int mp3_read_probe(AVProbeData *p)
 
     max_frames = 0;
     buf = buf0;
-    end = buf + p->buf_size - sizeof(uint32_t);
+    end = p->buf + p->buf_size - sizeof(uint32_t);
 
     for(; buf < end; buf= buf2+1) {
         buf2 = buf;
-- 
cgit v1.2.3