fix null pointer dereferences in intra channel and long term prediction (#234)

* fix null pointer dereference in intra channel prediction

Ensure "pred_stat" is not null in reconstruct_channel_pair(),
similar to the check in reconstruct_single_channel().

* fix null pointer dereference in long term prediction

Like ic_prediction(), lt_prediction() expects a "pred_stat" parameter
which is not null. Add checks to ensure that and add a new error message.

Author: radioactiveman

libfaad/error.c

@@ -65,6 +65,6 @@ char *err_msg[] = {
     "No standard extension payload allowed in DRM",
     "PCE shall be the first element in a frame",
     "Bitstream value not allowed by specification",
-	"MAIN prediction not initialised"
+    "MAIN prediction not initialised",
+    "Long term prediction not initialised"
 };
-

libfaad/error.h

@@ -35,7 +35,7 @@
 extern "C" {
 #endif
 
-#define NUM_ERROR_MESSAGES 34
+#define NUM_ERROR_MESSAGES 35
 extern char *err_msg[];
 
 #ifdef __cplusplus

libfaad/specrec.c

@@ -1006,8 +1006,8 @@ uint8_t reconstruct_single_channel(NeAACDecStruct *hDecoder, ic_stream *ics,
     /* MAIN object type prediction */
     if (hDecoder->object_type == MAIN)
     {
-		if (!hDecoder->pred_stat[sce->channel])
-			return 33;
+        if (!hDecoder->pred_stat[sce->channel])
+            return 33;
 
         /* intra channel prediction */
         ic_prediction(ics, spec_coef, hDecoder->pred_stat[sce->channel], hDecoder->frameLength,
@@ -1036,6 +1036,9 @@ uint8_t reconstruct_single_channel(NeAACDecStruct *hDecoder, ic_stream *ics,
         }
 #endif
 
+        if (!hDecoder->lt_pred_stat[sce->channel])
+            return 34;
+
         /* long term prediction */
         lt_prediction(ics, &(ics->ltp), spec_coef, hDecoder->lt_pred_stat[sce->channel], hDecoder->fb,
             ics->window_shape, hDecoder->window_shape_prev[sce->channel],
@@ -1240,6 +1243,9 @@ uint8_t reconstruct_channel_pair(NeAACDecStruct *hDecoder, ic_stream *ics1, ic_s
     /* MAIN object type prediction */
     if (hDecoder->object_type == MAIN)
     {
+        if (!hDecoder->pred_stat[cpe->channel] || !hDecoder->pred_stat[cpe->paired_channel])
+            return 33;
+
         /* intra channel prediction */
         ic_prediction(ics1, spec_coef1, hDecoder->pred_stat[cpe->channel], hDecoder->frameLength,
             hDecoder->sf_index);
@@ -1278,6 +1284,9 @@ uint8_t reconstruct_channel_pair(NeAACDecStruct *hDecoder, ic_stream *ics1, ic_s
         }
 #endif
 
+        if (!hDecoder->lt_pred_stat[cpe->channel] || !hDecoder->lt_pred_stat[cpe->paired_channel])
+            return 34;
+
         /* long term prediction */
         lt_prediction(ics1, ltp1, spec_coef1, hDecoder->lt_pred_stat[cpe->channel], hDecoder->fb,
             ics1->window_shape, hDecoder->window_shape_prev[cpe->channel],