ac3dec: fix processing of delta bit allocation information.

The number of dba segments is the coded value + 1.
The coupling dba offset starts at the first coupling band, not at zero.

libavcodec/ac3.c

@@ -192,9 +192,9 @@ int ff_ac3_bit_alloc_calc_mask(AC3BitAllocParameters *s, int16_t *band_psd,
 
     if (dba_mode == DBA_REUSE || dba_mode == DBA_NEW) {
         int i, seg, delta;
-        if (dba_nsegs >= 8)
+        if (dba_nsegs > 8)
             return -1;
-        band = 0;
+        band = band_start;
         for (seg = 0; seg < dba_nsegs; seg++) {
             band += dba_offsets[seg];
             if (band >= AC3_CRITICAL_BANDS || dba_lengths[seg] > AC3_CRITICAL_BANDS-band)

libavcodec/ac3dec.c

@@ -1173,8 +1173,8 @@ static int decode_audio_block(AC3DecodeContext *s, int blk)
         /* channel delta offset, len and bit allocation */
         for (ch = !cpl_in_use; ch <= fbw_channels; ch++) {
             if (s->dba_mode[ch] == DBA_NEW) {
-                s->dba_nsegs[ch] = get_bits(gbc, 3);
+                s->dba_nsegs[ch] = get_bits(gbc, 3) + 1;
-                for (seg = 0; seg <= s->dba_nsegs[ch]; seg++) {
+                for (seg = 0; seg < s->dba_nsegs[ch]; seg++) {
                     s->dba_offsets[ch][seg] = get_bits(gbc, 5);
                     s->dba_lengths[ch][seg] = get_bits(gbc, 4);
                     s->dba_values[ch][seg] = get_bits(gbc, 3);