Fix off-by-one buffer read access in format_track_path(). Part of #11947

We need to check for "i < max" first.

git-svn-id: svn://svn.rockbox.org/rockbox/trunk@29324 a1c6a512-1295-4272-9138-f99709370657

apps/playlist.c

@@ -1660,9 +1660,9 @@ static int format_track_path(char *dest, char *src, int buf_length, int max,
     char *temp_ptr;
 
     /* Zero-terminate the file name */
-    while((src[i] != '\n') &&
-          (src[i] != '\r') &&
-          (i < max))
+    while((i < max) &&
+          (src[i] != '\n') &&
+          (src[i] != '\r'))
         i++;
 
     /* Now work back killing white space */