perform sanity check on number of audio channels in avcodec_open()

Originally committed as revision 19877 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavcodec/utils.c b/libavcodec/utils.c
index 43147a5..e22bc33 100644 (file)
--- a/libavcodec/utils.c
+++ b/libavcodec/utils.c
@@ -471,7 +471,9 @@ int attribute_align_arg avcodec_open(AVCodecContext *avctx, AVCodec *codec)
     else if(avctx->width && avctx->height)
         avcodec_set_dimensions(avctx, avctx->width, avctx->height);
 
-    if((avctx->coded_width||avctx->coded_height) && avcodec_check_dimensions(avctx,avctx->coded_width,avctx->coded_height)){
+#define SANE_NB_CHANNELS 128U
+    if((avctx->coded_width||avctx->coded_height) && avcodec_check_dimensions(avctx,avctx->coded_width,avctx->coded_height) ||
+        avctx->channels > SANE_NB_CHANNELS) {
         av_freep(&avctx->priv_data);
         ret = AVERROR(EINVAL);
         goto end;