Check that all channel mapping entries used are valid

If channel numbers are changed on the fly (in invalid bitstreams),
we can end up with a channel mapping with fewer channels mapped
than we actually try to output.

Ideally, this condition should probably be checked somewhere
closer to where it enters such a state, not when using the
channel mapping though.

Fixes: 2808/clusterfuzz-testcase-minimized-4694952892170240
Fixes: 2275/clusterfuzz-testcase-minimized-6205444085252096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

libSBRdec/src/sbrdecoder.cpp

@@ -1444,6 +1444,9 @@ sbrDecoder_DecodeElement (
     self->flags |= (applyPs) ? SBRDEC_PS_DECODED : 0;
   }
 
+  if (channelMapping[0] == 255 || channelMapping[1] == 255)
+    return SBRDEC_UNSUPPORTED_CONFIG;
+
   /* Set strides for reading and writing */
   if (interleaved) {
     strideIn = numInChannels;