Properly null check many allocations that missed it

16 files changed, 137 insertions, 22 deletions

diff --git a/decoder/LAVAudio/parser/dts.cpp b/decoder/LAVAudio/parser/dts.cpp
index 878df8fe..0ace90cb 100644
--- a/decoder/LAVAudio/parser/dts.cpp
+++ b/decoder/LAVAudio/parser/dts.cpp
@@ -49,8 +49,8 @@ int init_dts_parser(DTSParserContext **pContext)
   if(!pContext) return -1;
 
   *pContext = (DTSParserContext *)malloc(sizeof(DTSParserContext));
+  if (*pContext == nullptr) return -1;
   memset(*pContext, 0, sizeof(DTSParserContext));
-  if(!*pContext) return -1;
 
   (*pContext)->gb = new GetBitContext();
 
diff --git a/decoder/LAVVideo/Filtering.cpp b/decoder/LAVVideo/Filtering.cpp
index 6867e92a..0b323f64 100644
--- a/decoder/LAVVideo/Filtering.cpp
+++ b/decoder/LAVVideo/Filtering.cpp
@@ -139,8 +139,13 @@ HRESULT CLAVVideo::Filter(LAVFrame *pFrame)
     if (!m_pFilterGraph)
       goto deliver;
 
-    if (pFrame->direct)
-      DeDirectFrame(pFrame, true);
+    if (pFrame->direct) {
+      HRESULT hr = DeDirectFrame(pFrame, true);
+      if (FAILED(hr)) {
+        ReleaseFrame(&pFrame);
+        return hr;
+      }
+    }
 
     AVFrame *in_frame = nullptr;
     BOOL refcountedFrame = (m_Decoder.HasThreadSafeBuffers() == S_OK);
diff --git a/decoder/LAVVideo/LAVPixFmtConverter.cpp b/decoder/LAVVideo/LAVPixFmtConverter.cpp
index 61cab3cf..c9f6a18c 100644
--- a/decoder/LAVVideo/LAVPixFmtConverter.cpp
+++ b/decoder/LAVVideo/LAVPixFmtConverter.cpp
@@ -574,6 +574,8 @@ const uint16_t* CLAVPixFmtConverter::GetRandomDitherCoeffs(int height, int coeff
     m_ditherHeight = height;
     m_ditherBits = bits;
     m_pRandomDithers = (uint16_t *)_aligned_malloc(m_ditherWidth * m_ditherHeight * 2, 16);
+    if (m_pRandomDithers == nullptr)
+      return nullptr;
 
 #ifdef DEBUG
     LARGE_INTEGER frequency, start, end;
diff --git a/decoder/LAVVideo/LAVVideo.cpp b/decoder/LAVVideo/LAVVideo.cpp
index a49b9101..d202c200 100644
--- a/decoder/LAVVideo/LAVVideo.cpp
+++ b/decoder/LAVVideo/LAVVideo.cpp
@@ -1415,7 +1415,12 @@ HRESULT CLAVVideo::DeDirectFrame(LAVFrame *pFrame, bool bDisableDirectMode)
 
   LAVDirectBuffer buffer;
   if (tmpFrame.direct_lock(&tmpFrame, &buffer)) {
-    AllocLAVFrameBuffers(pFrame, buffer.stride[0] / desc.codedbytes);
+    HRESULT hr = AllocLAVFrameBuffers(pFrame, buffer.stride[0] / desc.codedbytes);
+    if (FAILED(hr)) {
+      tmpFrame.direct_unlock(&tmpFrame);
+      FreeLAVFrameBuffers(&tmpFrame);
+      return hr;
+    }
 
     // use slow copy, this should only be used extremely rarely
     memcpy(pFrame->data[0], buffer.data[0], pFrame->height * buffer.stride[0]);
@@ -1425,7 +1430,11 @@ HRESULT CLAVVideo::DeDirectFrame(LAVFrame *pFrame, bool bDisableDirectMode)
     tmpFrame.direct_unlock(&tmpFrame);
   } else {
     // fallack, alloc anyway so nothing blows up
-    AllocLAVFrameBuffers(pFrame);
+    HRESULT hr = AllocLAVFrameBuffers(pFrame);
+    if (FAILED(hr)) {
+      FreeLAVFrameBuffers(&tmpFrame);
+      return hr;
+    }
   }
 
   FreeLAVFrameBuffers(&tmpFrame);
@@ -1531,18 +1540,26 @@ HRESULT CLAVVideo::DeliverToRenderer(LAVFrame *pFrame)
     if (pFrame->format != LAVPixFmt_DXVA2) {
       ReleaseFrame(&m_pLastSequenceFrame);
       if ((pFrame->flags & LAV_FRAME_FLAG_END_OF_SEQUENCE || m_bInDVDMenu)) {
-        if (pFrame->direct) DeDirectFrame(pFrame, false);
+        if (pFrame->direct) {
+          hr = DeDirectFrame(pFrame, false);
+          if (FAILED(hr)) {
+            ReleaseFrame(&pFrame);
+            return hr;
+          }
+        }
         CopyLAVFrame(pFrame, &m_pLastSequenceFrame);
       }
     } else {
       if ((pFrame->flags & LAV_FRAME_FLAG_END_OF_SEQUENCE || m_bInDVDMenu)) {
         if (!m_pLastSequenceFrame) {
-          AllocateFrame(&m_pLastSequenceFrame);
-          m_pLastSequenceFrame->format = LAVPixFmt_DXVA2;
+          hr = AllocateFrame(&m_pLastSequenceFrame);
+          if (SUCCEEDED(hr)) {
+            m_pLastSequenceFrame->format = LAVPixFmt_DXVA2;
 
-          hr = GetD3DBuffer(m_pLastSequenceFrame);
-          if (FAILED(hr)) {
-            ReleaseFrame(&m_pLastSequenceFrame);
+            hr = GetD3DBuffer(m_pLastSequenceFrame);
+            if (FAILED(hr)) {
+              ReleaseFrame(&m_pLastSequenceFrame);
+            }
           }
         }
         if (m_pLastSequenceFrame && m_pLastSequenceFrame->data[0] && m_pLastSequenceFrame->data[3]) {
@@ -1613,7 +1630,13 @@ HRESULT CLAVVideo::DeliverToRenderer(LAVFrame *pFrame)
     m_SubtitleConsumer->SetVideoSize(width, height);
     m_SubtitleConsumer->RequestFrame(pFrame->rtStart, pFrame->rtStop);
     if (!bRGBOut) {
-      if (pFrame->direct) DeDirectFrame(pFrame, true);
+      if (pFrame->direct) {
+        hr = DeDirectFrame(pFrame, true);
+        if (FAILED(hr)) {
+          ReleaseFrame(&pFrame);
+          return hr;
+        }
+      }
       m_SubtitleConsumer->ProcessFrame(pFrame);
     }
   }
@@ -1832,9 +1855,12 @@ HRESULT CLAVVideo::RedrawStillImage()
     LAVFrame *pFrame = nullptr;
 
     if (m_pLastSequenceFrame->format == LAVPixFmt_DXVA2) {
-      AllocateFrame(&pFrame);
+      HRESULT hr = AllocateFrame(&pFrame);
+      if (FAILED(hr))
+        return hr;
+
       *pFrame = *m_pLastSequenceFrame;
-      HRESULT hr = GetD3DBuffer(pFrame);
+      hr = GetD3DBuffer(pFrame);
       if (SUCCEEDED(hr)) {
         IMediaSample *pSample = (IMediaSample *)pFrame->data[0];
         IDirect3DSurface9 *pSurface = (IDirect3DSurface9 *)pFrame->data[3];
@@ -1857,7 +1883,10 @@ HRESULT CLAVVideo::RedrawStillImage()
       return hr;
     } else {
       LAVFrame *pFrame = nullptr;
-      CopyLAVFrame(m_pLastSequenceFrame, &pFrame);
+      HRESULT hr = CopyLAVFrame(m_pLastSequenceFrame, &pFrame);
+      if (FAILED(hr))
+        return hr;
+
       pFrame->flags |= LAV_FRAME_FLAG_REDRAW;
       return Deliver(pFrame);
     }
diff --git a/decoder/LAVVideo/Media.cpp b/decoder/LAVVideo/Media.cpp
index c5ccc910..407e257a 100644
--- a/decoder/LAVVideo/Media.cpp
+++ b/decoder/LAVVideo/Media.cpp
@@ -773,6 +773,9 @@ int CheckForSequenceMarkers(AVCodecID codec, const uint8_t *buf, long len, uint3
 
 int sws_scale2(struct SwsContext *c, const uint8_t *const srcSlice[], const ptrdiff_t srcStride[], int srcSliceY, int srcSliceH, uint8_t *const dst[], const ptrdiff_t dstStride[])
 {
+  if (!c)
+    return -1;
+
   int srcStride2[4];
   int dstStride2[4];
 
diff --git a/decoder/LAVVideo/decoders/avcodec.cpp b/decoder/LAVVideo/decoders/avcodec.cpp
index 73e3a323..f872f35d 100644
--- a/decoder/LAVVideo/decoders/avcodec.cpp
+++ b/decoder/LAVVideo/decoders/avcodec.cpp
@@ -1037,7 +1037,9 @@ STDMETHODIMP CDecAvcodec::GetPixelFormat(LAVPixelFormat *pPix, int *pBpp)
 STDMETHODIMP CDecAvcodec::ConvertPixFmt(AVFrame *pFrame, LAVFrame *pOutFrame)
 {
   // Allocate the buffers to write into
-  AllocLAVFrameBuffers(pOutFrame);
+  HRESULT hr = AllocLAVFrameBuffers(pOutFrame);
+  if (FAILED(hr))
+    return hr;
 
   // Map to swscale compatible format
   AVPixelFormat dstFormat = getFFPixelFormatFromLAV(pOutFrame->format, pOutFrame->bpp);
diff --git a/decoder/LAVVideo/decoders/dxva2dec.cpp b/decoder/LAVVideo/decoders/dxva2dec.cpp
index aa537bd4..9acf3c48 100644
--- a/decoder/LAVVideo/decoders/dxva2dec.cpp
+++ b/decoder/LAVVideo/decoders/dxva2dec.cpp
@@ -1549,7 +1549,13 @@ __forceinline bool CDecDXVA2::CopyFrame(LAVFrame *pFrame)
   pFrame->priv_data = nullptr;
 
   // Allocate memory buffers
-  AllocLAVFrameBuffers(pFrame, (pFrame->format == LAVPixFmt_P010) ? (LockedRect.Pitch >> 1) : LockedRect.Pitch);
+  hr = AllocLAVFrameBuffers(pFrame, (pFrame->format == LAVPixFmt_P010) ? (LockedRect.Pitch >> 1) : LockedRect.Pitch);
+  if (FAILED(hr)) {
+    pSurface->UnlockRect();
+    *pFrame = tmpFrame;
+    return false;
+  }
+
   // Copy surface onto memory buffers
   CopyFrameNV12((BYTE *)LockedRect.pBits, pFrame->data[0], pFrame->data[1], surfaceDesc.Height, pFrame->height, LockedRect.Pitch);
 
diff --git a/decoder/LAVVideo/decoders/msdk_mvc.cpp b/decoder/LAVVideo/decoders/msdk_mvc.cpp
index d81849f9..58a4e622 100644
--- a/decoder/LAVVideo/decoders/msdk_mvc.cpp
+++ b/decoder/LAVVideo/decoders/msdk_mvc.cpp
@@ -293,6 +293,10 @@ MVCBuffer * CDecMSDKMVC::GetBuffer()
 
     pBuffer->surface.Data.PitchLow = FFALIGN(m_mfxVideoParams.mfx.FrameInfo.Width, 64);
     pBuffer->surface.Data.Y  = (mfxU8 *)av_malloc(pBuffer->surface.Data.PitchLow * FFALIGN(m_mfxVideoParams.mfx.FrameInfo.Height, 64) * 3 / 2);
+    if (pBuffer->surface.Data.Y == nullptr) {
+      delete pBuffer;
+      return nullptr;
+    }
     pBuffer->surface.Data.UV = pBuffer->surface.Data.Y + (pBuffer->surface.Data.PitchLow * FFALIGN(m_mfxVideoParams.mfx.FrameInfo.Height, 64));
 
     m_BufferQueue.push_back(pBuffer);
@@ -426,6 +430,9 @@ STDMETHODIMP CDecMSDKMVC::Decode(const BYTE *buffer, int buflen, REFERENCE_TIME
   // Loop over the decoder to ensure all data is being consumed
   while (1) {
     MVCBuffer *pInputBuffer = GetBuffer();
+    if (pInputBuffer == nullptr)
+      return E_OUTOFMEMORY;
+
     mfxFrameSurface1 *outsurf = nullptr;
     sts = MFXVideoDECODE_DecodeFrameAsync(m_mfxSession, bFlush ? nullptr : &bs, &pInputBuffer->surface, &outsurf, &sync);
 
diff --git a/decoder/LAVVideo/decoders/pixfmt.cpp b/decoder/LAVVideo/decoders/pixfmt.cpp
index 9d141221..abdbbad3 100644
--- a/decoder/LAVVideo/decoders/pixfmt.cpp
+++ b/decoder/LAVVideo/decoders/pixfmt.cpp
@@ -119,6 +119,10 @@ HRESULT AllocLAVFrameBuffers(LAVFrame *pFrame, ptrdiff_t stride)
     ptrdiff_t planeStride = stride / desc.planeWidth[plane];
     size_t size = planeStride * (alignedHeight / desc.planeHeight[plane]);
     pFrame->data[plane]   = (BYTE *)_aligned_malloc(size + FF_INPUT_BUFFER_PADDING_SIZE, 64);
+    if (pFrame->data[plane] == nullptr) {
+      free_buffers(pFrame);
+      return E_OUTOFMEMORY;
+    }
     pFrame->stride[plane] = planeStride;
   }
 
@@ -126,6 +130,10 @@ HRESULT AllocLAVFrameBuffers(LAVFrame *pFrame, ptrdiff_t stride)
     for (int plane = 0; plane < desc.planes; plane++) {
       size_t size = pFrame->stride[plane] * (alignedHeight / desc.planeHeight[plane]);
       pFrame->stereo[plane] = (BYTE *)_aligned_malloc(size + FF_INPUT_BUFFER_PADDING_SIZE, 64);
+      if (pFrame->stereo[plane] == nullptr) {
+        free_buffers(pFrame);
+        return E_OUTOFMEMORY;
+      }
     }
   }
 
@@ -168,7 +176,9 @@ HRESULT CopyLAVFrame(LAVFrame *pSrc, LAVFrame **ppDst)
   (*ppDst)->destruct  = nullptr;
   (*ppDst)->priv_data = nullptr;
 
-  AllocLAVFrameBuffers(*ppDst);
+  HRESULT hr = AllocLAVFrameBuffers(*ppDst);
+  if (FAILED(hr))
+    return hr;
 
   LAVPixFmtDesc desc = getPixelFormatDesc(pSrc->format);
   for (int plane = 0; plane < desc.planes; plane++) {
diff --git a/decoder/LAVVideo/decoders/quicksync.cpp b/decoder/LAVVideo/decoders/quicksync.cpp
index 6028a75f..88a97493 100644
--- a/decoder/LAVVideo/decoders/quicksync.cpp
+++ b/decoder/LAVVideo/decoders/quicksync.cpp
@@ -383,6 +383,8 @@ STDMETHODIMP CDecQuickSync::InitDecoder(AVCodecID codec, const CMediaType *pmt)
   getExtraData(*pmt, nullptr, &extralen);
   if (extralen > 0) {
     extradata = (BYTE *)av_malloc(extralen + FF_INPUT_BUFFER_PADDING_SIZE);
+    if (extradata == nullptr)
+      return E_OUTOFMEMORY;
     getExtraData(*pmt, extradata, nullptr);
   }
 
diff --git a/decoder/LAVVideo/decoders/wmv9.cpp b/decoder/LAVVideo/decoders/wmv9.cpp
index 1b81fe87..117ea960 100644
--- a/decoder/LAVVideo/decoders/wmv9.cpp
+++ b/decoder/LAVVideo/decoders/wmv9.cpp
@@ -530,7 +530,13 @@ STDMETHODIMP CDecWMV9::ProcessOutput()
   // If not properly aligned, we need to make the data aligned.
   int alignment = (m_OutPixFmt == LAVPixFmt_NV12) ? 16 : 32;
   if ((pFrame->width % alignment) != 0) {
-    AllocLAVFrameBuffers(pFrame);
+    hr = AllocLAVFrameBuffers(pFrame);
+    if (FAILED(hr)) {
+      ReleaseBuffer(pBuffer);
+      SafeRelease(&pOutBuffer);
+      return hr;
+    }
+
     size_t ySize = pFrame->width * pFrame->height;
     memcpy_plane(pFrame->data[0], pBuffer, pFrame->width, pFrame->stride[0], pFrame->height);
     if (m_OutPixFmt == LAVPixFmt_NV12) {
diff --git a/decoder/LAVVideo/decoders/wmv9mft.cpp b/decoder/LAVVideo/decoders/wmv9mft.cpp
index ef4b9b4e..083014c8 100644
--- a/decoder/LAVVideo/decoders/wmv9mft.cpp
+++ b/decoder/LAVVideo/decoders/wmv9mft.cpp
@@ -556,7 +556,13 @@ STDMETHODIMP CDecWMV9MFT::ProcessOutput()
   // If not properly aligned, we need to make the data aligned.
   int alignment = (m_OutPixFmt == LAVPixFmt_NV12) ? 16 : 32;
   if ((pFrame->width % alignment) != 0) {
-    AllocLAVFrameBuffers(pFrame);
+    hr = AllocLAVFrameBuffers(pFrame);
+    if (FAILED(hr)) {
+      pMFBuffer->Unlock();
+      ReleaseBuffer(pMFBuffer);
+      SafeRelease(&OutputBuffer.pSample);
+      return hr;
+    }
     size_t ySize = pFrame->width * pFrame->height;
     
     memcpy_plane(pFrame->data[0], pBuffer, pFrame->width, pFrame->stride[0], pFrame->height);
diff --git a/decoder/LAVVideo/pixconv/convert_generic.cpp b/decoder/LAVVideo/pixconv/convert_generic.cpp
index decbad37..96121511 100644
--- a/decoder/LAVVideo/pixconv/convert_generic.cpp
+++ b/decoder/LAVVideo/pixconv/convert_generic.cpp
@@ -170,6 +170,8 @@ HRESULT CLAVPixFmtConverter::ConvertTo422Packed(const uint8_t* const src[4], con
     ptrdiff_t scaleStride = FFALIGN(width, 32);
 
     pTmpBuffer = (BYTE *)av_malloc(height * scaleStride * 2);
+    if (pTmpBuffer == nullptr)
+      return E_OUTOFMEMORY;
 
     tmp[0] = pTmpBuffer;
     tmp[1] = tmp[0] + (height * scaleStride);
@@ -266,6 +268,8 @@ HRESULT CLAVPixFmtConverter::ConvertToAYUV(const uint8_t* const src[4], const pt
     ptrdiff_t scaleStride = FFALIGN(width, 32);
 
     pTmpBuffer = (BYTE *)av_malloc(height * scaleStride * 3);
+    if (pTmpBuffer == nullptr)
+      return E_OUTOFMEMORY;
 
     tmp[0] = pTmpBuffer;
     tmp[1] = tmp[0] + (height * scaleStride);
@@ -337,6 +341,8 @@ HRESULT CLAVPixFmtConverter::ConvertToPX1X(const uint8_t* const src[4], const pt
     ptrdiff_t scaleStride = FFALIGN(width, 32) * 2;
 
     pTmpBuffer = (BYTE *)av_malloc(height * scaleStride * 2);
+    if (pTmpBuffer == nullptr)
+      return E_OUTOFMEMORY;
 
     tmp[0] = pTmpBuffer;
     tmp[1] = tmp[0] + (height * scaleStride);
@@ -443,6 +449,8 @@ HRESULT CLAVPixFmtConverter::ConvertToY410(const uint8_t* const src[4], const pt
     ptrdiff_t scaleStride = FFALIGN(width, 32);
 
     pTmpBuffer = (BYTE *)av_malloc(height * scaleStride * 6);
+    if (pTmpBuffer == nullptr)
+      return E_OUTOFMEMORY;
 
     tmp[0] = pTmpBuffer;
     tmp[1] = tmp[0] + (height * scaleStride * 2);
@@ -502,6 +510,8 @@ HRESULT CLAVPixFmtConverter::ConvertToY416(const uint8_t* const src[4], const pt
     ptrdiff_t scaleStride = FFALIGN(width, 32);
 
     pTmpBuffer = (BYTE *)av_malloc(height * scaleStride * 6);
+    if (pTmpBuffer == nullptr)
+      return E_OUTOFMEMORY;
 
     tmp[0] = pTmpBuffer;
     tmp[1] = tmp[0] + (height * scaleStride * 2);
@@ -556,6 +566,8 @@ HRESULT CLAVPixFmtConverter::ConvertTov210(const uint8_t* const src[4], const pt
     ptrdiff_t scaleStride = FFALIGN(width, 32);
 
     pTmpBuffer = (BYTE *)av_malloc(height * scaleStride * 6);
+    if (pTmpBuffer == nullptr)
+      return E_OUTOFMEMORY;
 
     tmp[0] = pTmpBuffer;
     tmp[1] = tmp[0] + (height * scaleStride * 2);
@@ -654,6 +666,8 @@ HRESULT CLAVPixFmtConverter::ConvertTov410(const uint8_t* const src[4], const pt
     ptrdiff_t scaleStride = FFALIGN(width, 32);
 
     pTmpBuffer = (BYTE *)av_malloc(height * scaleStride * 6);
+    if (pTmpBuffer == nullptr)
+      return E_OUTOFMEMORY;
 
     tmp[0] = pTmpBuffer;
     tmp[1] = tmp[0] + (height * scaleStride * 2);
diff --git a/decoder/LAVVideo/pixconv/rgb2rgb_unscaled.cpp b/decoder/LAVVideo/pixconv/rgb2rgb_unscaled.cpp
index 675fbc9f..bf8c775b 100644
--- a/decoder/LAVVideo/pixconv/rgb2rgb_unscaled.cpp
+++ b/decoder/LAVVideo/pixconv/rgb2rgb_unscaled.cpp
@@ -89,6 +89,8 @@ DECLARE_CONV_FUNC_IMPL(convert_rgb48_rgb)
   // Byte Swap to BGR layout
   uint8_t *dstBS[4]    = {nullptr};
   dstBS[0] = (BYTE *)av_malloc(height * srcStride[0]);
+  if (dstBS[0] == nullptr)
+    return E_OUTOFMEMORY;
 
   SwsContext *ctx = GetSWSContext(width, height, GetFFInput(), AV_PIX_FMT_BGR48LE, SWS_POINT);
   sws_scale2(ctx, src, srcStride, 0, height, dstBS, srcStride);
@@ -108,8 +110,13 @@ DECLARE_CONV_FUNC_IMPL(convert_rgb48_rgb)
   __m128i xmm0,xmm1,xmm6,xmm7;
 
   uint8_t *rgb24buffer = nullptr;
-  if (out32)
+  if (out32) {
     rgb24buffer = (uint8_t *)av_malloc(outStride + FF_INPUT_BUFFER_PADDING_SIZE);
+    if (rgb24buffer == nullptr) {
+      av_freep(&dstBS[0]);
+      return E_OUTOFMEMORY;
+    }
+  }
 
   _mm_sfence();
   for (line = 0; line < height; line++) {
diff --git a/decoder/LAVVideo/pixconv/yuv2rgb.cpp b/decoder/LAVVideo/pixconv/yuv2rgb.cpp
index c1cf8e25..acc31dcc 100644
--- a/decoder/LAVVideo/pixconv/yuv2rgb.cpp
+++ b/decoder/LAVVideo/pixconv/yuv2rgb.cpp
@@ -481,6 +481,8 @@ static int __stdcall yuv2rgb_convert(const uint8_t *srcY, const uint8_t *srcU, c
 DECLARE_CONV_FUNC_IMPL(convert_yuv_rgb)
 {
   const RGBCoeffs *coeffs = getRGBCoeffs(width, height);
+  if (coeffs == nullptr)
+    return E_OUTOFMEMORY;
 
   if (!m_bRGBConvInit) {
     m_bRGBConvInit = TRUE;
@@ -582,8 +584,11 @@ const RGBCoeffs* CLAVPixFmtConverter::getRGBCoeffs(int width, int height)
     swsWidth = width;
     swsHeight = height;
 
-    if (!m_rgbCoeffs)
+    if (!m_rgbCoeffs) {
       m_rgbCoeffs = (RGBCoeffs *)_aligned_malloc(sizeof(RGBCoeffs), 16);
+      if (m_rgbCoeffs == nullptr)
+        return nullptr;
+    }
 
     DXVA2_VideoTransferMatrix matrix = (DXVA2_VideoTransferMatrix)m_ColorProps.VideoTransferMatrix;
     if (matrix == DXVA2_VideoTransferMatrix_Unknown) {
diff --git a/decoder/LAVVideo/subtitles/LAVSubtitleConsumer.cpp b/decoder/LAVVideo/subtitles/LAVSubtitleConsumer.cpp
index 0eaa8497..5d1ab0b3 100644
--- a/decoder/LAVVideo/subtitles/LAVSubtitleConsumer.cpp
+++ b/decoder/LAVVideo/subtitles/LAVSubtitleConsumer.cpp
@@ -379,12 +379,17 @@ STDMETHODIMP CLAVSubtitleConsumer::ProcessSubtitleBitmap(LAVPixelFormat pixFmt,
       subStride[plane]  = stride / desc.planeWidth[plane];
       const size_t size = subStride[plane] * FFALIGN(newSize.cy, 2) / desc.planeHeight[plane];
       subData[plane]    = (BYTE *)av_mallocz(size + FF_INPUT_BUFFER_PADDING_SIZE);
+      if (subData[plane] == nullptr)
+        goto fail;
     }
 
     // Un-pre-multiply alpha for YUV formats
     // TODO: Can we SIMD this? See ARGBUnattenuateRow_C/SSE2 in libyuv
     if (avPixFmt != AV_PIX_FMT_BGRA) {
       tmpBuf = (uint8_t *)av_malloc(pitch * subSize.cy);
+      if (tmpBuf == nullptr)
+        goto fail;
+
       memcpy(tmpBuf, rgbData, pitch * subSize.cy);
       for (int line = 0; line < subSize.cy; line++) {
         uint8_t *p = tmpBuf + line * pitch;
@@ -423,4 +428,10 @@ STDMETHODIMP CLAVSubtitleConsumer::ProcessSubtitleBitmap(LAVPixelFormat pixFmt,
   }
 
   return S_OK;
+
+fail:
+  for (int i = 0; i < 4; i++) {
+    av_freep(&subData[i]);
+  }
+  return E_OUTOFMEMORY;
 }