faad: Fix a crash when channel info are invalids.

Fix #5433

diff --git a/modules/codec/faad.c b/modules/codec/faad.c
index f479199b1e37108cf3fee2f6a187d984481becd0..47e0ebd9846d9c36645eee9c0fd0fe420c6938fc 100644 (file)
--- a/modules/codec/faad.c
+++ b/modules/codec/faad.c
@@ -455,10 +455,19 @@ static aout_buffer_t *DecodeBlock( decoder_t *p_dec, block_t **pp_block )
             else
                 p_dec->fmt_out.audio.i_physical_channels |= pi_channels_out[j];
         }
-        p_dec->fmt_out.audio.i_original_channels =
-            p_dec->fmt_out.audio.i_physical_channels;
-
-        p_out = decoder_NewAudioBuffer(p_dec, frame.samples/frame.channels);
+        if ( nbChannels != frame.channels )
+        {
+            p_dec->fmt_out.audio.i_physical_channels
+                = p_dec->fmt_out.audio.i_original_channels
+                = pi_channels_guessed[nbChannels];
+        }
+        else
+        {
+            p_dec->fmt_out.audio.i_original_channels =
+                p_dec->fmt_out.audio.i_physical_channels;
+        }
+        p_dec->fmt_out.audio.i_channels = nbChannels;
+        p_out = decoder_NewAudioBuffer( p_dec, frame.samples / nbChannels );
         if( p_out == NULL )
         {
             p_sys->i_buffer = 0;
@@ -468,11 +477,11 @@ static aout_buffer_t *DecodeBlock( decoder_t *p_dec, block_t **pp_block )
 
         p_out->i_pts = date_Get( &p_sys->date );
         p_out->i_length = date_Increment( &p_sys->date,
-                                          frame.samples / frame.channels )
+                                          frame.samples / nbChannels )
                           - p_out->i_pts;
 
         DoReordering( (uint32_t *)p_out->p_buffer, samples,
-                      frame.samples / frame.channels, frame.channels,
+                      frame.samples / nbChannels, nbChannels,
                       p_sys->pi_channel_positions );
 
         p_sys->i_buffer -= frame.bytesconsumed;
@@ -509,7 +518,7 @@ static void Close( vlc_object_t *p_this )
 static void DoReordering( uint32_t *p_out, uint32_t *p_in, int i_samples,
                           int i_nb_channels, uint32_t *pi_chan_positions )
 {
-    int pi_chan_table[MAX_CHANNEL_POSITIONS];
+    int pi_chan_table[MAX_CHANNEL_POSITIONS] = {0};
     int i, j, k;
 
     /* Find the channels mapping */