matroskadec: fix out of bounds write

Signed-off-by: Janne Grunau <janne-libav@jannau.net>

diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 89df095..237e929 100644 (file)
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -1783,7 +1783,7 @@ static int matroska_parse_block(MatroskaDemuxContext *matroska, uint8_t *data,
                         lace_size[n] = lace_size[n - 1] + snum;
                         total += lace_size[n];
                     }
-                    lace_size[n] = size - total;
+                    lace_size[laces - 1] = size - total;
                     break;
                 }
             }