[SCM] libav/experimental: aacsbr: Check that bs_num_env is valid before writing arrays with it as an offset.

[siretart at users.alioth.debian.org]

The following commit has been merged in the experimental branch:
commit 6ebc7240606e8f1fccd2edbe4ffac150053a16cc
Author: Alex Converse <alex.converse at gmail.com>
Date:   Tue Mar 9 21:50:10 2010 +0000

    aacsbr: Check that bs_num_env is valid before writing arrays with it as an offset.
    
    Originally committed as revision 22413 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavcodec/aacsbr.c b/libavcodec/aacsbr.c
index 59517b1..6915152 100644
--- a/libavcodec/aacsbr.c
+++ b/libavcodec/aacsbr.c
@@ -689,7 +689,6 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
         num_rel_lead                        = get_bits(gb, 2);
         num_rel_trail                       = get_bits(gb, 2);
         ch_data->bs_num_env                 = num_rel_lead + num_rel_trail + 1;
-        ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail;
 
         if (ch_data->bs_num_env > 5) {
             av_log(ac->avccontext, AV_LOG_ERROR,
@@ -698,6 +697,8 @@ static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
             return -1;
         }
 
+        ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail;
+
         for (i = 0; i < num_rel_lead; i++)
             ch_data->t_env[i + 1] = ch_data->t_env[i] + 2 * get_bits(gb, 2) + 2;
         for (i = 0; i < num_rel_trail; i++)

-- 
Libav/FFmpeg packaging