android_window: check subtitles bounds

(fixes #13350)

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>

diff --git a/modules/video_output/android/android_window.c b/modules/video_output/android/android_window.c
index e584a54de8a490d578b56fdb023e081fb4e2bc9d..7a556648ca4d9238d1f5d1a1b09c98507a541c7f 100644 (file)
--- a/modules/video_output/android/android_window.c
+++ b/modules/video_output/android/android_window.c
@@ -878,8 +878,15 @@ static void SubtitleGetDirtyBounds(vout_display_t *vd,
         }
     }
 
-    /* default is full picture */
-    if (!b_found) {
+    if (!b_found
+     || p_out_bounds->left < 0
+     || p_out_bounds->right < 0
+     || (unsigned int) p_out_bounds->right > sys->p_sub_pic->format.i_width
+     || p_out_bounds->bottom < 0
+     || p_out_bounds->top < 0
+     || (unsigned int) p_out_bounds->top > sys->p_sub_pic->format.i_height)
+    {
+        /* default is full picture */
         p_out_bounds->left = 0;
         p_out_bounds->top = 0;
         p_out_bounds->right = sys->p_sub_pic->format.i_width;