Only in src: config.fate
Only in src: config.log
diff -ru ffmpeg-2.8.6/libavcodec/alac.c src/libavcodec/alac.c
--- ffmpeg-2.8.6/libavcodec/alac.c	2016-02-01 01:52:16.000000000 +0100
+++ src/libavcodec/alac.c	2016-02-03 20:54:46.807800321 +0100
@@ -476,6 +476,10 @@
             got_end = 1;
             break;
         }
+
+        if (ch >= alac->channels)
+            break;
+
         if (element > TYPE_CPE && element != TYPE_LFE) {
             av_log(avctx, AV_LOG_ERROR, "syntax element unsupported: %d\n", element);
             return AVERROR_PATCHWELCOME;
@@ -496,12 +500,13 @@
 
         ch += channels;
     }
-    if (!got_end) {
+
+    if (!got_end && ch < alac->channels) {
         av_log(avctx, AV_LOG_ERROR, "no end tag found. incomplete packet.\n");
         return AVERROR_INVALIDDATA;
     }
 
-    if (avpkt->size * 8 - get_bits_count(&alac->gb) > 8) {
+    if (avpkt->size * 8 - get_bits_count(&alac->gb) >= 32) {
         av_log(avctx, AV_LOG_ERROR, "Error : %d bits left\n",
                avpkt->size * 8 - get_bits_count(&alac->gb));
     }
Only in src/libavcodec: alac.c.orig