[CVE-2017-14633]: Don't allow for more than 256 channels

Change-Id: I17b8a0a97b4b97889bad757bb1ddfe20bb4331b4

diff --git a/lib/info.c b/lib/info.c
index c4706b0..ecced14 100644 (file)
--- a/lib/info.c
+++ b/lib/info.c
@@ -578,7 +578,7 @@ int vorbis_analysis_headerout(vorbis_dsp_state *v,
   oggpack_buffer opb;
   private_state *b=v->backend_state;
 
-  if(!b){
+  if(!b||vi->channels<=0||vi->channels>256){
     ret=OV_EFAULT;
     goto err_out;
   }