Sanitize audio format

THANKS

@@ -49,6 +49,7 @@ Daniel Stränger <vlc at schmaller d0t de> - M3U, xtag and playlist improvements
 David Kennedy <dkennedy at tinytoad.com> - X11 fullscreen patch
 Daniel Dreibrodt, aka aLtgLasS <daniel d.t dreibrodt -@t- gmx d0t de> - VLC 0.8.5 default skin
 Daniel Nylander <info@danielnylander at se> - Swedish translation
+David Thiel - security audit and report
 David Weber <david_weber at gmx.de> - Mac OS X interface design & graphics (v0.5.0)
 Davor Orel <syntheticamac at yahoo.it> - Mac OS X icons
 Dennis van Amerongen <Dennis dot vanAmerongen at nob dot nl> - x264 options unification

src/audio_output/dec.c

@@ -51,6 +51,21 @@ static aout_input_t * DecNew( vlc_object_t * p_this, aout_instance_t * p_aout,
     input_thread_t * p_input_thread;
     vlc_value_t val;
 
+    /* Sanitize audio format */
+    if( p_format->i_channels > 32 )
+    {
+        msg_Err( p_aout, "too many audio channels (%u)",
+                 p_format->i_channels );
+        goto error;
+    }
+
+    if( p_format->i_rate > 192000 )
+    {
+        msg_Err( p_aout, "excessive audio sample frequency (%u)",
+                 p_format->i_rate );
+        goto error;
+    }
+
     /* We can only be called by the decoder, so no need to lock
      * p_input->lock. */
     vlc_mutex_lock( &p_aout->mixer_lock );