display->y_pos = AV_RB16(buf) & 0xfff;
buf += 2;
+ if (display->x_pos >= region->width ||
+ display->y_pos >= region->height) {
+ av_log(avctx, AV_LOG_ERROR, "Object outside region\n");
+ av_free(display);
+ return AVERROR_INVALIDDATA;
+ }
+
if ((object->type == 1 || object->type == 2) && buf+1 < buf_end) {
display->fgcolor = *buf++;
display->bgcolor = *buf++;