commit 8acc0546bbb0deacdf1e79f5486a0811840246fc
author Ronald S. Bultje <rsbultje@gmail.com> Sat Oct 15 00:03:55 2011 +0200
committer Michael Niedermayer <michaelni@gmx.at> Sun Nov 06 19:49:12 2011 +0100
tree 1f2f9f6334c0c3d9edabd51cfbe11190547dfcfd
parent 36e4be0a0adc18358a59043167a55da8eac16023

matroskadec: fix out of bounds write

Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 723229c11f1400e6a09c8a1c9c27193f376eb1d1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d51c7b4cbe022f6b3b026735dc7e29eb50bbf129)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

libavformat/matroskadec.c

diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index d9ffec3..0d75c5c 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -1641,7 +1641,7 @@
                         lace_size[n] = lace_size[n - 1] + snum;
                         total += lace_size[n];
                     }
-                    lace_size[n] = size - total;
+                    lace_size[laces - 1] = size - total;
                     break;
                 }
             }