vlc_bits: add shift guard on bs_read

and reject any reads > 32

(cherry picked from commit 86c35629d7)

include/vlc_bits.h

@@ -96,9 +96,15 @@ static inline uint32_t bs_read( bs_t *s, int i_count )
         0x1fffff,  0x3fffff,  0x7fffff,  0xffffff,
         0x1ffffff, 0x3ffffff, 0x7ffffff, 0xfffffff,
         0x1fffffff,0x3fffffff,0x7fffffff,0xffffffff};
-    int      i_shr;
+    int      i_shr, i_drop = 0;
     uint32_t i_result = 0;
 
+    if( i_count > 32 )
+    {
+        i_drop = i_count - 32;
+        i_count = 32;
+    }
+
     while( i_count > 0 )
     {
         if( s->p >= s->p_end )
@@ -116,18 +122,24 @@ static inline uint32_t bs_read( bs_t *s, int i_count )
                 bs_forward( s, 1 );
                 s->i_left = 8;
             }
-            return( i_result );
+            break;
         }
         else
         {
             /* less in the buffer than requested */
-           i_result |= (*s->p&i_mask[s->i_left]) << -i_shr;
+           if( -i_shr == 32 )
+               i_result = 0;
+           else
+               i_result |= (*s->p&i_mask[s->i_left]) << -i_shr;
            i_count  -= s->i_left;
            bs_forward( s, 1);
            s->i_left = 8;
         }
     }
 
+    if( i_drop )
+        bs_forward( s, i_drop );
+
     return( i_result );
 }