All mp3 parsers are buggy fix 2 of n (out of array write, i suspect not exploitable)

git-svn-id: file:///var/local/repositories/ffmpeg/trunk@14070 9553f0bf-9b14-0410-a0b8-cfaf0461ba5b

libavformat/mp3.c

@@ -205,7 +205,7 @@ static void id3v2_read_ttag(AVFormatContext *s, int taglen, char *dst, int dstle
         break;
 
     case 3:  /* UTF-8 */
-        len = FFMIN(taglen, dstlen);
+        len = FFMIN(taglen, dstlen-1);
         get_buffer(s->pb, dst, len);
         dst[len] = 0;
         break;