Buffer overrun in III_dequantize_sample

Hello,

I've been doing some testing of the latest LAME in CVS and there's the
possibility to cause a buffer overrun in III_dequantize_sample by inputting
a malformed file. It would appear to not be exploitable, but it should
probably be fixed.

Unfortunately I'm not an audio developer and a lot of the code is
mysterious to me. I'm therefore having trouble identifying the root cause.
(e.g. I don't know whether there simply needs to be a bounds check in the
affected function, or whether there is an initialisation issue further down
the call stack that needs to be addressed.)

It would appear that the issue occurs when:

sfreq == 3;
gr_infos->block_type == 2
gr_infos->mixed_block_flag is true

However, there might be additional factors. I have an input file that
reproduces the issue. Would anyone be able to help me identify the root
cause?
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot