if (s->mcdparams[i].present) {
s->mcdparams[i].index = get_bits(gb, 2);
s->mcdparams[i].chan2 = get_bits(gb, 4);
+ if (s->mcdparams[i].chan2 >= avctx->channels) {
+ av_log(avctx, AV_LOG_ERROR,
+ "invalid channel 2 (%d) for %d channel(s)\n",
+ s->mcdparams[i].chan2, avctx->channels);
+ return AVERROR_INVALIDDATA;
+ }
if (s->mcdparams[i].index == 1) {
if ((nbit == s->mcdparams[i].chan2) ||
(ch_mask & 1 << s->mcdparams[i].chan2))