summaryrefslogtreecommitdiff
path: root/libavcodec/mpegaudiodec.c
diff options
context:
space:
mode:
Diffstat (limited to 'libavcodec/mpegaudiodec.c')
-rw-r--r--libavcodec/mpegaudiodec.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/mpegaudiodec.c b/libavcodec/mpegaudiodec.c
index 8f748f48a9..e4073ee8df 100644
--- a/libavcodec/mpegaudiodec.c
+++ b/libavcodec/mpegaudiodec.c
@@ -1965,7 +1965,7 @@ static int decode_frame_mp3on4(AVCodecContext *avctx, void *data,
avpriv_mpegaudio_decode_header((MPADecodeHeader *)m, header);
- if (ch + m->nb_channels > avctx->channels) {
+ if (ch + m->nb_channels > avctx->channels || s->coff[fr] + m->nb_channels > avctx->channels) {
av_log(avctx, AV_LOG_ERROR, "frame channel count exceeds codec "
"channel count\n");
return AVERROR_INVALIDDATA;