Merge tag 'n0.8.15' into release/0.7

FFmpeg 0.8.15 release

* tag 'n0.8.15': (49 commits)
  update for 0.8.15
  avcodec/ffv1enc: update buffer check for 16bps
  avcodec/dsputil: fix signedness in sizeof() comparissions
  avcodec/pngdsp: fix (un)signed type in end comparission
  matroska_read_seek: Fix used streams for subtitle index compensation
  jpeg2000: check log2_cblk dimensions
  avcodec/rpza: Perform pointer advance and checks before using the pointers
  update all trac links to use the trac subdomain
  doc/APIchanges: List merge commit hashes and version numbers
  apichanges: fix 2 wrong hashes
  avcodec/parser: reset indexes on realloc failure
  mpeg12dec: avoid reinitialization on PS changes when possible.
  mpegts: only reopen pmt_cb filter if its different from the previous.
  Autodetect idcin only if audio properties allow decoding.
  alacenc: Fix missing sign_extend()
  h264_cavlc: fix reading skip run
  Update changelog for 0.7.8 release
  aac: check the maximum number of channels
  oggdec: fix faulty cleanup prototype
  qdm2: check that the FFT size is a power of 2
  ...

Conflicts:
	Doxyfile
	RELEASE
	VERSION
	libavformat/matroskadec.c

Merged-by: Michael Niedermayer <[email protected]>

1 files changed, 2 insertions, 0 deletions

diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c
index 78176d0053..41c4ea262b 100644
--- a/libavcodec/aacdec.c
+++ b/libavcodec/aacdec.c
@@ -183,6 +183,8 @@ static av_cold int che_configure(AACContext *ac,
                                  enum ChannelPosition che_pos[4][MAX_ELEM_ID],
                                  int type, int id, int *channels)
 {
+    if (*channels >= MAX_CHANNELS)
+        return AVERROR_INVALIDDATA;
     if (che_pos[type][id]) {
         if (!ac->che[type][id] && !(ac->che[type][id] = av_mallocz(sizeof(ChannelElement))))
             return AVERROR(ENOMEM);