Bundled faad2 is 2.8.8 (pre-fix) — excluded_channels heap overflow

external/CMakeLists.txt fetches faad2 2.8.8 (ExternalProject URL), which is before the 2.9.0 fix (commit 942c3e0a) for a heap overflow in excluded_channels(): the DRC parser's exclude_mask write loop has no MAX_CHANNELS bound, so a FIL/DRC extension payload with enough additional_excluded_chns=1 bits writes past the drc_info allocation.

The DAB demodulator feeds DAB+ AAC access units to NeAACDecDecode(), which runs this parser per frame on attacker-controlled broadcast/recorded input.

Fix: bump the fetched faad2 to >= 2.9.0. 2.9.x still uses the autotools configure build, so the existing CONFIGURE_COMMAND keeps working; 2.10+ moved to CMake and would need the ExternalProject build commands changed too. The bundled copy is built only when no system faad2 is used, so this affects the Windows/macOS binaries and source-fallback builds.

[]