Paul Gofman : winegstreamer: Validate maximum channel count in _SetInputType in AAC decoder.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: bb95f8c2f6fd46e922debcefc7a05509acdc48e9
URL:    https://gitlab.winehq.org/wine/wine/-/commit/bb95f8c2f6fd46e922debcefc7a0550...

Author: Paul Gofman 
Date:   Mon Sep 18 20:28:15 2023 -0600

winegstreamer: Validate maximum channel count in _SetInputType in AAC decoder.

---

dlls/mf/tests/transform.c        | 2 +-
 dlls/winegstreamer/aac_decoder.c | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/dlls/mf/tests/transform.c b/dlls/mf/tests/transform.c
index eadde5237f0..787f7663d84 100644
--- a/dlls/mf/tests/transform.c
+++ b/dlls/mf/tests/transform.c
@@ -2586,7 +2586,7 @@ static void test_aac_decoder_channels(const struct attribute_desc *input_type_de
             ok(hr == S_OK, "got %#lx.\n", hr);
         else
         {
-            todo_wine ok(hr == MF_E_INVALIDMEDIATYPE, "got %#lx.\n", hr);
+            ok(hr == MF_E_INVALIDMEDIATYPE, "got %#lx.\n", hr);
             winetest_pop_context();
             continue;
         }
diff --git a/dlls/winegstreamer/aac_decoder.c b/dlls/winegstreamer/aac_decoder.c
index cdd4cc18477..35689a49c38 100644
--- a/dlls/winegstreamer/aac_decoder.c
+++ b/dlls/winegstreamer/aac_decoder.c
@@ -374,6 +374,7 @@ static HRESULT WINAPI transform_SetInputType(IMFTransform *iface, DWORD id, IMFM
 {
     struct aac_decoder *decoder = impl_from_IMFTransform(iface);
     MF_ATTRIBUTE_TYPE item_type;
+    UINT32 channel_count;
     GUID major, subtype;
     HRESULT hr;
     ULONG i;
@@ -396,6 +397,10 @@ static HRESULT WINAPI transform_SetInputType(IMFTransform *iface, DWORD id, IMFM
     if (i == ARRAY_SIZE(aac_decoder_input_types))
         return MF_E_INVALIDMEDIATYPE;

+    if (SUCCEEDED(IMFMediaType_GetUINT32(type, &MF_MT_AUDIO_NUM_CHANNELS, &channel_count))
+            && channel_count >= ARRAY_SIZE(default_channel_mask))
+        return MF_E_INVALIDMEDIATYPE;
+
     if (FAILED(IMFMediaType_GetItemType(type, &MF_MT_AUDIO_SAMPLES_PER_SECOND, &item_type))
             || item_type != MF_ATTRIBUTE_UINT32)
         return MF_E_INVALIDMEDIATYPE;