* prevent potential crashes on files with broken channelcount

modules/codec/realaudio.c

@@ -185,6 +185,14 @@ static int Open( vlc_object_t *p_this )
         return VLC_EGENERIC;
     }
 
+    if( p_dec->fmt_in.audio.i_channels <= 0 ||
+        p_dec->fmt_in.audio.i_channels > 6 )
+    {
+        msg_Err( p_dec, "invalid number of channels (not between 1 and 6): %i",
+                 p_dec->fmt_in.audio.i_channels );
+        return VLC_EGENERIC;
+    }
+
     p_dec->p_sys = p_sys = malloc( sizeof( decoder_sys_t ) );
     memset( p_sys, 0, sizeof(decoder_sys_t) );
 

modules/codec/speex.c

@@ -383,6 +383,13 @@ static int ProcessInitialHeader( decoder_t *p_dec, ogg_packet *p_oggpacket )
         callback.data = &p_sys->stereo;
         speex_decoder_ctl( p_state, SPEEX_SET_HANDLER, &callback );
     }
+    if( p_header->nb_channels <= 0 ||
+        p_header->nb_channels > 5 )
+    {
+        msg_Err( p_dec, "invalid number of channels (not between 1 and 5): %i",
+                 p_header->nb_channels );
+        return VLC_EGENERIC;
+    }
 
     /* Setup the format */
     p_dec->fmt_out.audio.i_physical_channels =

modules/codec/vorbis.c

@@ -387,6 +387,15 @@ static int ProcessHeaders( decoder_t *p_dec )
     /* Setup the format */
     p_dec->fmt_out.audio.i_rate     = p_sys->vi.rate;
     p_dec->fmt_out.audio.i_channels = p_sys->vi.channels;
+
+    if( p_dec->fmt_out.audio.i_channels < 0 ||
+        p_dec->fmt_out.audio.i_channels > 6 )
+    {
+        msg_Err( p_dec, "invalid number of channels (not between 1 and 6): %i",
+                 p_dec->fmt_out.audio.i_channels );
+        return VLC_EGENERIC;
+    }
+
     p_dec->fmt_out.audio.i_physical_channels =
         p_dec->fmt_out.audio.i_original_channels =
             pi_channels_maps[p_sys->vi.channels];