off by 1 in the palette

Originally committed as revision 2548 to svn://svn.ffmpeg.org/ffmpeg/trunk

libavformat/ipmovie.c

@@ -452,7 +452,7 @@ static int process_ipmovie_chunk(IPMVEContext *s, ByteIOContext *pb,
 
             /* load the palette into internal data structure */
             first_color = LE_16(&scratch[0]);
-            last_color = first_color + LE_16(&scratch[2]);
+            last_color = first_color + LE_16(&scratch[2]) - 1;
             /* sanity check (since they are 16 bit values) */
             if ((first_color > 0xFF) || (last_color > 0xFF)) {
                 debug_ipmovie("demux_ipmovie: set_palette indices out of range (%d -> %d)\n",