wavpack: Properly check channel index, dont write out of arrays

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 5 insertions, 5 deletions

diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c
index cf1bccf464..a6ce0f42a3 100644
--- a/libavcodec/wavpack.c
+++ b/libavcodec/wavpack.c
@@ -788,11 +788,6 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no,
         return AVERROR_INVALIDDATA;
     }
 
-    if (wc->ch_offset >= avctx->channels) {
-        av_log(avctx, AV_LOG_ERROR, "too many channels\n");
-        return -1;
-    }
-
     memset(s->decorr, 0, MAX_TERMS * sizeof(Decorr));
     memset(s->ch, 0, sizeof(s->ch));
     s->extra_bits     = 0;
@@ -829,6 +824,11 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no,
     s->hybrid_minclip = ((-1LL << (orig_bpp - 1)));
     s->CRC            = bytestream2_get_le32(&gb);
 
+    if (wc->ch_offset + s->stereo >= avctx->channels) {
+        av_log(avctx, AV_LOG_ERROR, "too many channels\n");
+        return -1;
+    }
+
     samples_l = data[wc->ch_offset];
     if (s->stereo)
         samples_r = data[wc->ch_offset + 1];