Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
}
channels = (element == TYPE_CPE) ? 2 : 1;
}
channels = (element == TYPE_CPE) ? 2 : 1;
- if (ch + channels > alac->channels) {
+ if ( ch + channels > alac->channels
+ || alac_channel_layout_offsets[alac->channels - 1][ch] + channels > alac->channels
+ ) {
av_log(avctx, AV_LOG_ERROR, "invalid element channel count\n");
return AVERROR_INVALIDDATA;
}
av_log(avctx, AV_LOG_ERROR, "invalid element channel count\n");
return AVERROR_INVALIDDATA;
}