[SCM] libav/experimental: mlpdec: Fix possible writing out of array bounds introduced by being under-paranoid in r18651.

[siretart at users.alioth.debian.org]

The following commit has been merged in the experimental branch:
commit e2822726677e3e8870ae4145377505925261e03b
Author: Ramiro Polla <ramiro.polla at gmail.com>
Date:   Wed May 6 16:01:28 2009 +0000

    mlpdec: Fix possible writing out of array bounds introduced by being
    under-paranoid in r18651.
    
    Originally committed as revision 18763 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavcodec/mlpdec.c b/libavcodec/mlpdec.c
index f1a3b3a..0a64d79 100644
--- a/libavcodec/mlpdec.c
+++ b/libavcodec/mlpdec.c
@@ -377,6 +377,15 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp,
         return -1;
     }
 
+    /* This should happen for TrueHD streams with >6 channels and MLP's noise
+     * type. It is not yet known if this is allowed. */
+    if (s->max_channel > MAX_MATRIX_CHANNEL_MLP && !s->noise_type) {
+        av_log(m->avctx, AV_LOG_ERROR,
+               "Number of channels %d is larger than the maximum supported "
+               "by the decoder. %s\n", s->max_channel+2, sample_message);
+        return -1;
+    }
+
     if (s->min_channel > s->max_channel) {
         av_log(m->avctx, AV_LOG_ERROR,
                "Substream min channel cannot be greater than max channel.\n");

-- 
Libav/FFmpeg packaging