From ecb2ad9a7b72b9fe96720c59289e5ccd9bf0f433 Mon Sep 17 00:00:00 2001
From: Martin Storsjo <martin@martin.st>
Date: Thu, 3 Aug 2017 12:51:43 +0300
Subject: [PATCH] Check that all channel mapping entries used are valid

If channel numbers are changed on the fly (in invalid bitstreams),
we can end up with a channel mapping with fewer channels mapped
than we actually try to output.

Ideally, this condition should probably be checked somewhere
closer to where it enters such a state, not when using the
channel mapping though.

Fixes: 2808/clusterfuzz-testcase-minimized-4694952892170240
Fixes: 2275/clusterfuzz-testcase-minimized-6205444085252096

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
---
 libSBRdec/src/sbrdecoder.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libSBRdec/src/sbrdecoder.cpp b/libSBRdec/src/sbrdecoder.cpp
index f9ded54..766d7e9 100644
--- a/libSBRdec/src/sbrdecoder.cpp
+++ b/libSBRdec/src/sbrdecoder.cpp
@@ -1444,6 +1444,9 @@ sbrDecoder_DecodeElement (
     self->flags |= (applyPs) ? SBRDEC_PS_DECODED : 0;
   }
 
+  if (channelMapping[0] == 255 || channelMapping[1] == 255)
+    return SBRDEC_UNSUPPORTED_CONFIG;
+
   /* Set strides for reading and writing */
   if (interleaved) {
     strideIn = numInChannels;