avidec: use actually read size instead of requested size

Fixes CVE-2012-2788

diff --git a/libavformat/avidec.c b/libavformat/avidec.c
index b70367fb30aede96de0038ba1e4037c0cf86a66d..b2a06edd8c1f0f3e0656dbfe6d6247e32e4f6c9d 100644 (file)
--- a/libavformat/avidec.c
+++ b/libavformat/avidec.c
@@ -1116,7 +1116,7 @@ resync:
             }
             ast->frame_offset += get_duration(ast, pkt->size);
         }
-        ast->remaining -= size;
+        ast->remaining -= err;
         if(!ast->remaining){
             avi->stream_index= -1;
             ast->packet_size= 0;