[FFmpeg-cvslog] adpcm: fix off by 1 error and out of array access in DK4

[Michael Niedermayer]

ffmpeg | branch: release/1.0 | Michael Niedermayer <michaelni at gmx.at> | Wed Dec 12 17:14:32 2012 +0100| [85a14dbd5dca34320f58b1ba11dd6dd0df4fb3be] | committer: Michael Niedermayer

adpcm: fix off by 1 error and out of array access in DK4

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit f18c873ab5ee3c78d00fdcc2582b39c133faecb4)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=85a14dbd5dca34320f58b1ba11dd6dd0df4fb3be
---

 libavcodec/adpcm.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c
index c779f8b..683a231 100644
--- a/libavcodec/adpcm.c
+++ b/libavcodec/adpcm.c
@@ -755,7 +755,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,
                 return AVERROR_INVALIDDATA;
             }
         }
-        for (n = nb_samples >> (1 - st); n > 0; n--) {
+        for (n = (nb_samples - 1) >> (1 - st); n > 0; n--) {
             int v = bytestream2_get_byteu(&gb);
             *samples++ = adpcm_ima_expand_nibble(&c->status[0 ], v >> 4  , 3);
             *samples++ = adpcm_ima_expand_nibble(&c->status[st], v & 0x0F, 3);