From bcaa9099b3648b47060e1724a97dc98b63c83702 Mon Sep 17 00:00:00 2001
From: wm4 <nfxjfg@googlemail.com>
Date: Wed, 7 Jan 2015 23:57:50 +0100
Subject: [PATCH] avcodec/dvdsubdec: error on bitmaps with size 0

Attemtping to decode them could lead to invalid writes with some fuzzed
samples.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
---
 libavcodec/dvdsubdec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavcodec/dvdsubdec.c b/libavcodec/dvdsubdec.c
index 2423cadcaa..1cc34ead17 100644
--- a/libavcodec/dvdsubdec.c
+++ b/libavcodec/dvdsubdec.c
@@ -111,6 +111,9 @@ static int decode_rle(uint8_t *bitmap, int linesize, int w, int h,
     if (start >= buf_size)
         return -1;
 
+    if (w <= 0 || h <= 0)
+        return -1;
+
     bit_len = (buf_size - start) * 8;
     init_get_bits(&gb, buf + start, bit_len);