From 94968dbc1116e23cb658c09538e9bce52b63d654 Mon Sep 17 00:00:00 2001
From: Limin Wang <lance.lmwang@gmail.com>
Date: Sun, 8 May 2022 22:52:14 +0800
Subject: [PATCH] avcodec/dvdsubenc: return error if canvas_size is too small
 for subtitle render

Signed-off-by: Limin Wang <lance.lmwang@gmail.com>
---
 libavcodec/dvdsubenc.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/libavcodec/dvdsubenc.c b/libavcodec/dvdsubenc.c
index fc3b7d1816..d29db7d49c 100644
--- a/libavcodec/dvdsubenc.c
+++ b/libavcodec/dvdsubenc.c
@@ -376,6 +376,12 @@ static int encode_dvd_subtitles(AVCodecContext *avctx,
     x2 = vrect.x + vrect.w - 1;
     y2 = vrect.y + vrect.h - 1;
 
+    if (x2 > avctx->width || y2 > avctx->height) {
+        av_log(avctx, AV_LOG_ERROR, "canvas_size(%d:%d) is too small(%d:%d) for render\n",
+               avctx->width, avctx->height, x2, y2);
+        ret = AVERROR(EINVAL);;
+        goto fail;
+    }
     *q++ = 0x05;
     // x1 x2 -> 6 nibbles
     *q++ = vrect.x >> 4;