Fix possible buffer over-read in vorbis_comment, fix it double to be sure.
First, make s signed, so that comparisons against end - p will not be made as unsigned, making the check incorrectly pass if p is beyond end. Also ensure that p will never be > end, so the code is correct also if buf is not padded. Originally committed as revision 20014 to svn://svn.ffmpeg.org/ffmpeg/trunk
Showing with 5 additions and 4 deletions