aac: check the maximum number of channels

Broken bitstreams could report a larger than specified number of
channels and cause outbound writes.

CC:libav-stable@libav.org
(cherry picked from commit a943a132f3)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavcodec/aacdec.c
This commit is contained in:
Reinhard Tartler 2013-05-07 07:13:50 +02:00
parent 7bf6a86f2e
commit a590979988

View File

@ -192,6 +192,8 @@ static av_cold int che_configure(AACContext *ac,
enum ChannelPosition che_pos[4][MAX_ELEM_ID],
int type, int id, int *channels)
{
if (*channels >= MAX_CHANNELS)
return AVERROR_INVALIDDATA;
if (che_pos[type][id]) {
if (!ac->che[type][id]) {
if (!(ac->che[type][id] = av_mallocz(sizeof(ChannelElement))))