X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fdvdsubdec.c;h=741ea9fd1e7377d946e1c4464681e9836a0fe4a9;hb=a11aa5f3ed7ee4d2385a7b725d43f6070d790b4c;hp=13d52c8c688b9ce9a566c8edf3815fcc8fb07c2f;hpb=71bf0330505e2108935d05c5c018ec65eac4b946;p=ffmpeg

diff --git a/libavcodec/dvdsubdec.c b/libavcodec/dvdsubdec.c
index 13d52c8c688..741ea9fd1e7 100644
--- a/libavcodec/dvdsubdec.c
+++ b/libavcodec/dvdsubdec.c
@@ -125,6 +125,8 @@ static int decode_rle(uint8_t *bitmap, int linesize, int w, int h, uint8_t used_
             len = decode_run_8bit(&gb, &color);
         else
             len = decode_run_2bit(&gb, &color);
+        if (len != INT_MAX && len > w - x)
+            return AVERROR_INVALIDDATA;
         len = FFMIN(len, w - x);
         memset(d + x, color, len);
         used_color[color] = 1;
@@ -593,6 +595,7 @@ static int dvdsub_decode(AVCodecContext *avctx,
     }
 
     if (is_menu < 0) {
+        ctx->buf_size = 0;
     no_subtitle:
         reset_rects(sub);
         *data_size = 0;