diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c
index 6478c7765b..24e6ca6a87 100644
--- a/libavcodec/aacdec.c
+++ b/libavcodec/aacdec.c
@@ -192,6 +192,8 @@ static av_cold int che_configure(AACContext *ac,
                                  enum ChannelPosition che_pos[4][MAX_ELEM_ID],
                                  int type, int id, int *channels)
 {
+    if (*channels >= MAX_CHANNELS)
+        return AVERROR_INVALIDDATA;
     if (che_pos[type][id]) {
         if (!ac->che[type][id]) {
             if (!(ac->che[type][id] = av_mallocz(sizeof(ChannelElement))))