Merge commit '7f75f2f2bd692857c1c1ca7f414eb30ece3de93d'

[ffmpeg] / libavcodec / aacdec.c

diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c
index 37c7de5e90fcf961c8ff0b68101f3e465817d186..f60060adb525122ef2d11c30474c6ed3155e0971 100644 (file)
--- a/libavcodec/aacdec.c
+++ b/libavcodec/aacdec.c
@@ -148,6 +148,8 @@ static av_cold int che_configure(AACContext *ac,
                                  enum ChannelPosition che_pos,
                                  int type, int id, int *channels)
 {
+    if (*channels >= MAX_CHANNELS)
+        return AVERROR_INVALIDDATA;
     if (che_pos) {
         if (!ac->che[type][id]) {
             if (!(ac->che[type][id] = av_mallocz(sizeof(ChannelElement))))