mlpdec: Validate max_channel and max_matrix_channel.

Originally committed as revision 18649 to svn://svn.ffmpeg.org/ffmpeg/trunk

libavcodec/mlp.h

@@ -26,6 +26,9 @@
 
 #include "avcodec.h"
 
+/** Last possible matrix channel for each codec */
+#define MAX_MATRIX_CHANNEL_MLP      5
+#define MAX_MATRIX_CHANNEL_TRUEHD   7
 /** Maximum number of channels that can be decoded. */
 #define MAX_CHANNELS        16
 

libavcodec/mlpdec.c

@@ -335,6 +335,9 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp,
     uint8_t checksum;
     uint8_t lossless_check;
     int start_count = get_bits_count(gbp);
+    const int max_matrix_channel = m->avctx->codec_id == CODEC_ID_MLP
+                                 ? MAX_MATRIX_CHANNEL_MLP
+                                 : MAX_MATRIX_CHANNEL_TRUEHD;
 
     sync_word = get_bits(gbp, 13);
     s->noise_type = get_bits1(gbp);
@@ -352,6 +355,19 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp,
     s->max_channel        = get_bits(gbp, 4);
     s->max_matrix_channel = get_bits(gbp, 4);
 
+    if (s->max_matrix_channel > max_matrix_channel) {
+        av_log(m->avctx, AV_LOG_ERROR,
+               "Max matrix channel cannot be greater than %d.\n",
+               max_matrix_channel);
+        return -1;
+    }
+
+    if (s->max_channel != s->max_matrix_channel) {
+        av_log(m->avctx, AV_LOG_ERROR,
+               "Max channel must be equal max matrix channel.\n");
+        return -1;
+    }
+
     if (s->min_channel > s->max_channel) {
         av_log(m->avctx, AV_LOG_ERROR,
                "Substream min channel cannot be greater than max channel.\n");