Fix a possible endless loop when decoding aac.

Fixes ticket #789.
(cherry picked from commit e5de928923)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

libavcodec/aacdec.c

@@ -819,10 +819,10 @@ static int decode_band_types(AACContext *ac, enum BandType band_type[120],
                 av_log(ac->avctx, AV_LOG_ERROR, "invalid band type\n");
                 return -1;
             }
-            while ((sect_len_incr = get_bits(gb, bits)) == (1 << bits) - 1)
+            while ((sect_len_incr = get_bits(gb, bits)) == (1 << bits) - 1 && get_bits_left(gb) >= bits)
                 sect_end += sect_len_incr;
             sect_end += sect_len_incr;
-            if (get_bits_left(gb) < 0) {
+            if (get_bits_left(gb) < 0 || sect_len_incr == (1 << bits) - 1) {
                 av_log(ac->avctx, AV_LOG_ERROR, overread_err);
                 return -1;
             }