avfilter/af_pan: check the id of named input channels before use

parse_channel_name() only rejects negative values on the named channel
path, while the numbered "c%d" path also checks against MAX_CHANNELS.
av_channel_from_string() accepts UNSD (512), UNK (768) and AMBI (1024),
and the id was then used directly to index used_in_ch[MAX_CHANNELS] on
the stack and pan->gain[out_ch_id][in_ch_id].

Before this change:

  ffmpeg -f lavfi -i "anullsrc=cl=stereo" -af "pan=stereo|FL=AMBI" -f null -
  af_pan.c:214:17: runtime error: index 1024 out of bounds for type 'int[64]'

The first out of bounds access is the read at the "reference twice"
check, so the symptom depends on what happens to be on the stack:
FL=UNK is silently accepted and produces silence, FL=UNSD reports
"Can not reference in channel 512 twice", and FL=AMBI aborts.

The check has to be at the caller and not in parse_channel_name(), which
is shared with the out channel path: there the named id is converted by
av_channel_layout_index_from_channel() into a layout index, so high ids
are legitimately supported and "pan=AMBI|AMBI=FL" works.

AVERROR_PATCHWELCOME is used because these are valid AVChannel values
that af_pan cannot represent: for named input channels the gain matrix is
indexed by the raw id, and the renumbering loop in config_props() is
bounded by MAX_CHANNELS as well, so such a mapping never worked.

The in_ch_id < 0 half is currently unreachable and only kept for symmetry
with the out channel check above.

Regression since 1f96db959c, which dropped
the "channel_id >= MAX_CHANNELS" part of the check when converting to the
new channel layout API.

Reported-by: karnakarreddi
Fixes: #22963
Signed-off-by: iSold Leo <s@qwqlog.com>

libavfilter/af_pan.c

@@ -211,6 +211,12 @@ static av_cold int init(AVFilterContext *ctx)
                 ret = AVERROR(EINVAL);
                 goto fail;
             }
+            if (in_ch_id < 0 || in_ch_id >= MAX_CHANNELS) {
+                av_log(ctx, AV_LOG_ERROR,
+                       "Input channel id %d is not supported\n", in_ch_id);
+                ret = AVERROR_PATCHWELCOME;
+                goto fail;
+            }
             if (used_in_ch[in_ch_id]) {
                 av_log(ctx, AV_LOG_ERROR,
                        "Can not reference in channel %d twice\n", in_ch_id);