Merge commit 'ec17782e17de1e8501ca213e276dfe5412ff1d11'

* commit 'ec17782e17de1e8501ca213e276dfe5412ff1d11':
  dvdsubdec: Check memory allocations

Conflicts:
	libavcodec/dvdsubdec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 9 insertions, 2 deletions

diff --git a/libavcodec/dvdsubdec.c b/libavcodec/dvdsubdec.c
index 9a49d8f071..ffb2bcc115 100644
--- a/libavcodec/dvdsubdec.c
+++ b/libavcodec/dvdsubdec.c
@@ -360,11 +360,16 @@ static int decode_dvd_subtitles(DVDSubContext *ctx, AVSubtitle *sub_header,
             if (w > 0 && h > 0) {
                 reset_rects(sub_header);
 
-                bitmap = av_malloc(w * h);
                 sub_header->rects = av_mallocz(sizeof(*sub_header->rects));
+                if (!sub_header->rects)
+                    goto fail;
                 sub_header->rects[0] = av_mallocz(sizeof(AVSubtitleRect));
+                if (!sub_header->rects[0])
+                    goto fail;
                 sub_header->num_rects = 1;
-                sub_header->rects[0]->pict.data[0] = bitmap;
+                bitmap = sub_header->rects[0]->pict.data[0] = av_malloc(w * h);
+                if (!bitmap)
+                    goto fail;
                 if (decode_rle(bitmap, w * 2, w, (h + 1) / 2,
                                buf, offset1, buf_size, is_8bit) < 0)
                     goto fail;
@@ -372,6 +377,8 @@ static int decode_dvd_subtitles(DVDSubContext *ctx, AVSubtitle *sub_header,
                                buf, offset2, buf_size, is_8bit) < 0)
                     goto fail;
                 sub_header->rects[0]->pict.data[1] = av_mallocz(AVPALETTE_SIZE);
+                if (!sub_header->rects[0]->pict.data[1])
+                    goto fail;
                 if (is_8bit) {
                     if (!yuv_palette)
                         goto fail;