From 5db50265be1ba6537daa3a08ac368668bf1455b0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hugo=20Beauz=C3=A9e-Luyssen?= <beauze.h@gmail.com>
Date: Fri, 4 May 2012 15:15:40 +0200
Subject: [PATCH] faad: Fix a crash when channel info are invalids.

Fix #5433
---
 modules/codec/faad.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/modules/codec/faad.c b/modules/codec/faad.c
index f479199b1e..47e0ebd984 100644
--- a/modules/codec/faad.c
+++ b/modules/codec/faad.c
@@ -455,10 +455,19 @@ static aout_buffer_t *DecodeBlock( decoder_t *p_dec, block_t **pp_block )
             else
                 p_dec->fmt_out.audio.i_physical_channels |= pi_channels_out[j];
         }
-        p_dec->fmt_out.audio.i_original_channels =
-            p_dec->fmt_out.audio.i_physical_channels;
-
-        p_out = decoder_NewAudioBuffer(p_dec, frame.samples/frame.channels);
+        if ( nbChannels != frame.channels )
+        {
+            p_dec->fmt_out.audio.i_physical_channels
+                = p_dec->fmt_out.audio.i_original_channels
+                = pi_channels_guessed[nbChannels];
+        }
+        else
+        {
+            p_dec->fmt_out.audio.i_original_channels =
+                p_dec->fmt_out.audio.i_physical_channels;
+        }
+        p_dec->fmt_out.audio.i_channels = nbChannels;
+        p_out = decoder_NewAudioBuffer( p_dec, frame.samples / nbChannels );
         if( p_out == NULL )
         {
             p_sys->i_buffer = 0;
@@ -468,11 +477,11 @@ static aout_buffer_t *DecodeBlock( decoder_t *p_dec, block_t **pp_block )
 
         p_out->i_pts = date_Get( &p_sys->date );
         p_out->i_length = date_Increment( &p_sys->date,
-                                          frame.samples / frame.channels )
+                                          frame.samples / nbChannels )
                           - p_out->i_pts;
 
         DoReordering( (uint32_t *)p_out->p_buffer, samples,
-                      frame.samples / frame.channels, frame.channels,
+                      frame.samples / nbChannels, nbChannels,
                       p_sys->pi_channel_positions );
 
         p_sys->i_buffer -= frame.bytesconsumed;
@@ -509,7 +518,7 @@ static void Close( vlc_object_t *p_this )
 static void DoReordering( uint32_t *p_out, uint32_t *p_in, int i_samples,
                           int i_nb_channels, uint32_t *pi_chan_positions )
 {
-    int pi_chan_table[MAX_CHANNEL_POSITIONS];
+    int pi_chan_table[MAX_CHANNEL_POSITIONS] = {0};
     int i, j, k;
 
     /* Find the channels mapping */
-- 
GitLab