Asserting on some ctl() calls that should never fail
diff --git a/celt/arch.h b/celt/arch.h
index ffca8cf..ad7bf28 100644
--- a/celt/arch.h
+++ b/celt/arch.h
@@ -79,9 +79,11 @@
 
 #define celt_assert(cond) {if (!(cond)) {CELT_FATAL("assertion failed: " #cond);}}
 #define celt_assert2(cond, message) {if (!(cond)) {CELT_FATAL("assertion failed: " #cond "\n" message);}}
+#define MUST_SUCCEED(call) celt_assert((call) == OPUS_OK)
 #else
 #define celt_assert(cond)
 #define celt_assert2(cond, message)
+#define MUST_SUCCEED(call) do {if((call) != OPUS_OK) {RESTORE_STACK; return OPUS_INTERNAL_ERROR;} } while (0)
 #endif
 
 #if defined(ENABLE_ASSERTIONS)
diff --git a/src/opus_decoder.c b/src/opus_decoder.c
index 02a88dc..483d918 100644
--- a/src/opus_decoder.c
+++ b/src/opus_decoder.c
@@ -488,9 +488,9 @@
          celt_assert(0);
          break;
       }
-      celt_decoder_ctl(celt_dec, CELT_SET_END_BAND(endband));
+      MUST_SUCCEED(celt_decoder_ctl(celt_dec, CELT_SET_END_BAND(endband)));
    }
-   celt_decoder_ctl(celt_dec, CELT_SET_CHANNELS(st->stream_channels));
+   MUST_SUCCEED(celt_decoder_ctl(celt_dec, CELT_SET_CHANNELS(st->stream_channels)));
 
    /* Only allocation memory for redundancy if/when needed */
    redundant_audio_size = redundancy ? F5*st->channels : ALLOC_NONE;
@@ -499,21 +499,21 @@
    /* 5 ms redundant frame for CELT->SILK*/
    if (redundancy && celt_to_silk)
    {
-      celt_decoder_ctl(celt_dec, CELT_SET_START_BAND(0));
+      MUST_SUCCEED(celt_decoder_ctl(celt_dec, CELT_SET_START_BAND(0)));
       celt_decode_with_ec(celt_dec, data+len, redundancy_bytes,
                           redundant_audio, F5, NULL, 0);
-      celt_decoder_ctl(celt_dec, OPUS_GET_FINAL_RANGE(&redundant_rng));
+      MUST_SUCCEED(celt_decoder_ctl(celt_dec, OPUS_GET_FINAL_RANGE(&redundant_rng)));
    }
 
    /* MUST be after PLC */
-   celt_decoder_ctl(celt_dec, CELT_SET_START_BAND(start_band));
+   MUST_SUCCEED(celt_decoder_ctl(celt_dec, CELT_SET_START_BAND(start_band)));
 
    if (mode != MODE_SILK_ONLY)
    {
       int celt_frame_size = IMIN(F20, frame_size);
       /* Make sure to discard any previous CELT state */
       if (mode != st->prev_mode && st->prev_mode > 0 && !st->prev_redundancy)
-         celt_decoder_ctl(celt_dec, OPUS_RESET_STATE);
+         MUST_SUCCEED(celt_decoder_ctl(celt_dec, OPUS_RESET_STATE));
       /* Decode CELT */
       celt_ret = celt_decode_with_ec(celt_dec, decode_fec ? NULL : data,
                                      len, pcm, celt_frame_size, &dec, celt_accum);
@@ -528,7 +528,7 @@
          do a fade-out by decoding a silence frame */
       if (st->prev_mode == MODE_HYBRID && !(redundancy && celt_to_silk && st->prev_redundancy) )
       {
-         celt_decoder_ctl(celt_dec, CELT_SET_START_BAND(0));
+         MUST_SUCCEED(celt_decoder_ctl(celt_dec, CELT_SET_START_BAND(0)));
          celt_decode_with_ec(celt_dec, silence, 2, pcm, F2_5, NULL, celt_accum);
       }
    }
@@ -546,18 +546,18 @@
 
    {
       const CELTMode *celt_mode;
-      celt_decoder_ctl(celt_dec, CELT_GET_MODE(&celt_mode));
+      MUST_SUCCEED(celt_decoder_ctl(celt_dec, CELT_GET_MODE(&celt_mode)));
       window = celt_mode->window;
    }
 
    /* 5 ms redundant frame for SILK->CELT */
    if (redundancy && !celt_to_silk)
    {
-      celt_decoder_ctl(celt_dec, OPUS_RESET_STATE);
-      celt_decoder_ctl(celt_dec, CELT_SET_START_BAND(0));
+      MUST_SUCCEED(celt_decoder_ctl(celt_dec, OPUS_RESET_STATE));
+      MUST_SUCCEED(celt_decoder_ctl(celt_dec, CELT_SET_START_BAND(0)));
 
       celt_decode_with_ec(celt_dec, data+len, redundancy_bytes, redundant_audio, F5, NULL, 0);
-      celt_decoder_ctl(celt_dec, OPUS_GET_FINAL_RANGE(&redundant_rng));
+      MUST_SUCCEED(celt_decoder_ctl(celt_dec, OPUS_GET_FINAL_RANGE(&redundant_rng)));
       smooth_fade(pcm+st->channels*(frame_size-F2_5), redundant_audio+st->channels*F2_5,
                   pcm+st->channels*(frame_size-F2_5), F2_5, st->channels, window, st->Fs);
    }
@@ -893,7 +893,7 @@
          goto bad_arg;
       }
       if (st->prev_mode == MODE_CELT_ONLY)
-         celt_decoder_ctl(celt_dec, OPUS_GET_PITCH(value));
+         ret = celt_decoder_ctl(celt_dec, OPUS_GET_PITCH(value));
       else
          *value = st->DecControl.prevPitchLag;
    }
@@ -935,7 +935,7 @@
        {
           goto bad_arg;
        }
-       celt_decoder_ctl(celt_dec, OPUS_SET_PHASE_INVERSION_DISABLED(value));
+       ret = celt_decoder_ctl(celt_dec, OPUS_SET_PHASE_INVERSION_DISABLED(value));
    }
    break;
    case OPUS_GET_PHASE_INVERSION_DISABLED_REQUEST:
@@ -945,7 +945,7 @@
        {
           goto bad_arg;
        }
-       celt_decoder_ctl(celt_dec, OPUS_GET_PHASE_INVERSION_DISABLED(value));
+       ret = celt_decoder_ctl(celt_dec, OPUS_GET_PHASE_INVERSION_DISABLED(value));
    }
    break;
    default: