# HG changeset patch
# User ramiro
# Date 1241625688 0
# Node ID 2d9e7d5cd89b7bc07f74461e73d20f97e58de9d8
# Parent  56f0a40547703bd3bf24b31adc59c41732b48efc
mlpdec: Fix possible writing out of array bounds introduced by being
under-paranoid in r18651.

diff -r 56f0a4054770 -r 2d9e7d5cd89b mlpdec.c
--- a/mlpdec.c	Wed May 06 15:46:10 2009 +0000
+++ b/mlpdec.c	Wed May 06 16:01:28 2009 +0000
@@ -377,6 +377,15 @@
         return -1;
     }
 
+    /* This should happen for TrueHD streams with >6 channels and MLP's noise
+     * type. It is not yet known if this is allowed. */
+    if (s->max_channel > MAX_MATRIX_CHANNEL_MLP && !s->noise_type) {
+        av_log(m->avctx, AV_LOG_ERROR,
+               "Number of channels %d is larger than the maximum supported "
+               "by the decoder. %s\n", s->max_channel+2, sample_message);
+        return -1;
+    }
+
     if (s->min_channel > s->max_channel) {
         av_log(m->avctx, AV_LOG_ERROR,
                "Substream min channel cannot be greater than max channel.\n");