Merge cherrypicks of [12730462, 12730463, 12729574, 12730525, 12730638, 12730639, 12730640, 12730641, 12730642, 12730643, 12730564, 12730542, 12730526, 12730527, 12730543, 12729545, 12729634, 12730565, 12730531, 12730645, 12730545, 12730406] into rvc-d1-releaseandroid-11.0.0_r15android-11.0.0_r14android-11.0.0_r13android-11.0.0_r12android11-d1-s7-releaseandroid11-d1-s6-releaseandroid11-d1-s5-releaseandroid11-d1-release

Change-Id: I15a9e31379a956ba45d669af3bceaece02faafc6

1 files changed, 6 insertions, 6 deletions

diff --git a/libSBRdec/src/sbrdecoder.cpp b/libSBRdec/src/sbrdecoder.cpp
index 6e4aad4..55f929f 100644
--- a/libSBRdec/src/sbrdecoder.cpp
+++ b/libSBRdec/src/sbrdecoder.cpp
@@ -1,7 +1,7 @@
 /* -----------------------------------------------------------------------------
 Software License for The Fraunhofer FDK AAC Codec Library for Android
 
-© Copyright  1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten
+© Copyright  1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten
 Forschung e.V. All rights reserved.
 
  1.    INTRODUCTION
@@ -617,10 +617,6 @@ SBR_ERROR sbrDecoder_InitElement(
       self->numSbrChannels -= self->pSbrElement[elementIndex]->nChannels;
     }
 
-    /* Save element ID for sanity checks and to have a fallback for concealment.
-     */
-    self->pSbrElement[elementIndex]->elementID = elementID;
-
     /* Determine amount of channels for this element */
     switch (elementID) {
       case ID_NONE:
@@ -653,12 +649,16 @@ SBR_ERROR sbrDecoder_InitElement(
     }
 
     /* Sanity check to avoid memory leaks */
-    if (elChannels < self->pSbrElement[elementIndex]->nChannels) {
+    if (elChannels < self->pSbrElement[elementIndex]->nChannels ||
+        (self->numSbrChannels + elChannels) > (8) + (1)) {
       self->numSbrChannels += self->pSbrElement[elementIndex]->nChannels;
       sbrError = SBRDEC_PARSE_ERROR;
       goto bail;
     }
 
+    /* Save element ID for sanity checks and to have a fallback for concealment.
+     */
+    self->pSbrElement[elementIndex]->elementID = elementID;
     self->pSbrElement[elementIndex]->nChannels = elChannels;
 
     for (ch = 0; ch < elChannels; ch++) {