From 9622db1d4fb8a312be5d63c3a21d6ebdb2a66720 Mon Sep 17 00:00:00 2001
From: "Ronald S. Bultje" <rbultje@ronald.bitfreak.net>
Date: Wed, 24 Mar 2004 04:21:38 +0000
Subject: [PATCH] gst/mpegaudioparse/gstmpegaudioparse.c: Fix buffer overflow
 read error.

Original commit message from CVS:
* gst/mpegaudioparse/gstmpegaudioparse.c: (gst_mp3parse_chain):
Fix buffer overflow read error.
---
 ChangeLog                              | 5 +++++
 gst/mpegaudioparse/gstmpegaudioparse.c | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 330d3aa555..bbb22ddc71 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2004-03-23  Ronald Bultje  <rbultje@ronald.bitfreak.net>
+
+	* gst/mpegaudioparse/gstmpegaudioparse.c: (gst_mp3parse_chain):
+	  Fix buffer overflow read error.
+
 2004-03-23  Ronald Bultje  <rbultje@ronald.bitfreak.net>
 
 	* ext/alsa/gstalsa.h:
diff --git a/gst/mpegaudioparse/gstmpegaudioparse.c b/gst/mpegaudioparse/gstmpegaudioparse.c
index 4e5b9b004e..a4152dea29 100644
--- a/gst/mpegaudioparse/gstmpegaudioparse.c
+++ b/gst/mpegaudioparse/gstmpegaudioparse.c
@@ -330,7 +330,7 @@ gst_mp3parse_chain (GstPad * pad, GstData * _data)
     GST_DEBUG ("mp3parse: offset %ld, size %ld ", offset, size);
 
     /* search for a possible start byte */
-    for (; ((data[offset] != 0xff) && (offset < size)); offset++)
+    for (; ((offset < size - 4) && (data[offset] != 0xff)); offset++)
       skipped++;
     if (skipped && !mp3parse->in_flush) {
       GST_DEBUG ("mp3parse: **** now at %ld skipped %d bytes", offset, skipped);