wmalosslessdec: rawpcm_tile fixes to keep get_bits() values within defined range.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

libavcodec/wmalosslessdec.c

@@ -936,12 +936,16 @@ static int decode_subframe(WmallDecodeCtx *s)
 
     if (rawpcm_tile) {
         int bits = s->bits_per_sample - padding_zeroes;
+        if (bits <= 0 ) {
+            av_log(s->avctx, AV_LOG_ERROR, "rawpcm_tile bits invalid\n");
+            return -1;
+        }
         av_dlog(s->avctx, "RAWPCM %d bits per sample. "
                 "total %d bits, remain=%d\n", bits,
                 bits * s->num_channels * subframe_len, get_bits_count(&s->gb));
         for (i = 0; i < s->num_channels; i++)
             for (j = 0; j < subframe_len; j++)
-                s->channel_coeffs[i][j] = get_sbits(&s->gb, bits);
+                s->channel_coeffs[i][j] = get_sbits_long(&s->gb, bits);
     } else {
         for (i = 0; i < s->num_channels; i++)
             if (s->is_channel_coded[i]) {