Merge commit 'ec17782e17de1e8501ca213e276dfe5412ff1d11'

* commit 'ec17782e17de1e8501ca213e276dfe5412ff1d11':
  dvdsubdec: Check memory allocations

Conflicts:
	libavcodec/dvdsubdec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

diff --cc libavcodec/dvdsubdec.c
index 9a49d8f,bc5a3a7..ffb2bcc
--- 1/libavcodec/dvdsubdec.c
--- 2/libavcodec/dvdsubdec.c
+++ b/libavcodec/dvdsubdec.c
@@@ -358,22 -314,35 +358,29 @@@ static int decode_dvd_subtitles(DVDSubC
              if (h < 0)
                  h = 0;
              if (w > 0 && h > 0) {
 -                if (sub_header->rects) {
 -                    for (i = 0; i < sub_header->num_rects; i++) {
 -                        av_freep(&sub_header->rects[i]->pict.data[0]);
 -                        av_freep(&sub_header->rects[i]->pict.data[1]);
 -                        av_freep(&sub_header->rects[i]);
 -                    }
 -                    av_freep(&sub_header->rects);
 -                    sub_header->num_rects = 0;
 -                }
 +                reset_rects(sub_header);
  
-                 bitmap = av_malloc(w * h);
                  sub_header->rects = av_mallocz(sizeof(*sub_header->rects));
+                 if (!sub_header->rects)
+                     goto fail;
                  sub_header->rects[0] = av_mallocz(sizeof(AVSubtitleRect));
+                 if (!sub_header->rects[0])
+                     goto fail;
                  sub_header->num_rects = 1;
-                 sub_header->rects[0]->pict.data[0] = bitmap;
+                 bitmap = sub_header->rects[0]->pict.data[0] = av_malloc(w * h);
+                 if (!bitmap)
+                     goto fail;
 -                decode_rle(bitmap, w * 2, w, (h + 1) / 2,
 -                           buf, offset1, buf_size, is_8bit);
 -                decode_rle(bitmap + w, w * 2, w, h / 2,
 -                           buf, offset2, buf_size, is_8bit);
 +                if (decode_rle(bitmap, w * 2, w, (h + 1) / 2,
 +                               buf, offset1, buf_size, is_8bit) < 0)
 +                    goto fail;
 +                if (decode_rle(bitmap + w, w * 2, w, h / 2,
 +                               buf, offset2, buf_size, is_8bit) < 0)
 +                    goto fail;
                  sub_header->rects[0]->pict.data[1] = av_mallocz(AVPALETTE_SIZE);
+                 if (!sub_header->rects[0]->pict.data[1])
+                     goto fail;
                  if (is_8bit) {
 -                    if (yuv_palette == 0)
 +                    if (!yuv_palette)
                          goto fail;
                      sub_header->rects[0]->nb_colors = 256;
                      yuv_a_to_rgba(yuv_palette, alpha, (uint32_t*)sub_header->rects[0]->pict.data[1], 256);