Off by one fix to prevent possible segfault. Patch by jwestfall at surrealistic dot net.

Originally committed as revision 4857 to svn://svn.ffmpeg.org/ffmpeg/trunk

libavcodec/mpeg12.c

@@ -2178,7 +2178,7 @@ static int find_start_code(const uint8_t **pbuf_ptr, const uint8_t *buf_end)
     const uint8_t *buf_ptr= *pbuf_ptr;
 
     buf_ptr++; //gurantees that -1 is within the array
-    buf_end -= 2; // gurantees that +2 is within the array
+    buf_end -= 3; // gurantees that +3 is within the array
 
     while (buf_ptr < buf_end) {
         if(*buf_ptr==0){
@@ -2192,7 +2192,7 @@ static int find_start_code(const uint8_t **pbuf_ptr, const uint8_t *buf_end)
         }
         buf_ptr += 2;
     }
-    buf_end += 2; //undo the hack above
+    buf_end += 3; //undo the hack above
 
     *pbuf_ptr = buf_end;
     return -1;