latmdec: Check AudioSpecificConfig length before decoding extradata.

This is different than a normal get_bits() over read because
decode_audio_specific_config() creates its own GetBitContext.

Fixes Bug 170.

diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c
index b2fc740..ca1a876 100644 (file)
--- a/libavcodec/aacdec.c
+++ b/libavcodec/aacdec.c
@@ -2363,6 +2363,8 @@ static int latm_decode_audio_specific_config(struct LATMContext *latmctx,
                                "config not byte aligned.\n", 1);
         return AVERROR_INVALIDDATA;
     }
+    if (asclen <= 0)
+        return AVERROR_INVALIDDATA;
     bits_consumed = decode_audio_specific_config(NULL, avctx, &m4ac,
                                          gb->buffer + (config_start_bit / 8),
                                          asclen, sync_extension);