OpusHeader: Add error checks in ParseOpusHeader()

Add error checks for invalid number of coupled streams and channel
mapping values

Bug: 148771305
Test: test in bug
Change-Id: I0d8fcbaa514dfe55a94246f8f847be9a14be7a60

media/libstagefright/foundation/OpusHeader.cpp

@@ -126,12 +126,20 @@ bool ParseOpusHeader(const uint8_t* data, size_t data_size, OpusHeader* header)
     }
     header->num_streams = data[kOpusHeaderNumStreamsOffset];
     header->num_coupled = data[kOpusHeaderNumCoupledStreamsOffset];
-    if (header->num_streams + header->num_coupled != header->channels) {
+    if (header->num_coupled > header->num_streams ||
-        ALOGV("Inconsistent channel mapping.");
+        header->num_streams + header->num_coupled != header->channels) {
+        ALOGV("Inconsistent channel mapping, streams: %d coupled: %d channels: %d",
+        header->num_streams, header->num_coupled, header->channels);
         return false;
     }
-    for (int i = 0; i < header->channels; ++i)
+    for (int i = 0; i < header->channels; ++i) {
-        header->stream_map[i] = data[kOpusHeaderStreamMapOffset + i];
+        uint8_t value = data[kOpusHeaderStreamMapOffset + i];
+        if (value != 255 && value >= header->channels) {
+            ALOGV("Invalid channel mapping for index %i : %d", i, value);
+            return false;
+        }
+        header->stream_map[i] = value;
+    }
     return true;
 }