4 files changed, 7 insertions, 2 deletions
diff --git a/CONTRIBUTORS b/CONTRIBUTORS
index e3f95046..b5f831df 100644
--- a/CONTRIBUTORS
+++ b/CONTRIBUTORS
@@ -1256,6 +1256,7 @@ Marco Schlüßler <marco@lordzodiac.de>
  for fixing initializing the day index when editing the weekday parameter of a
  repeating timer
  for figuring out some obscure length bytes the the CA PMT Reply data of AlphaCrypt CAMs
+ for fixing handling OSD areas that have invalid sizes
 
 Jürgen Schmitz <j.schmitz@web.de>
  for reporting a bug in displaying the current channel when switching via the SVDRP
diff --git a/HISTORY b/HISTORY
index e72ee5b6..83b13aca 100644
--- a/HISTORY
+++ b/HISTORY
@@ -3986,3 +3986,4 @@ Video Disk Recorder Revision History
   actually removing it (unless a new recording requires the disk space).
 - Fixed a possible crash when displaying the "Low disk space!" message from
   a background thread (thanks to Christof Steininger).
+- Fixed handling OSD areas that have invalid sizes (thanks to Marco Schlüßler).
diff --git a/dvbosd.c b/dvbosd.c
index 458ec9ce..da58d99c 100644
--- a/dvbosd.c
+++ b/dvbosd.c
@@ -4,7 +4,7 @@
  * See the main source file 'vdr.c' for copyright information and
  * how to reach the author.
  *
- * $Id: dvbosd.c 1.27 2005/05/22 10:57:45 kls Exp $
+ * $Id: dvbosd.c 1.28 2005/12/18 12:56:55 kls Exp $
  */
 
 #include "dvbosd.h"
@@ -88,6 +88,8 @@ eOsdError cDvbOsd::CanHandleAreas(const tArea *Areas, int NumAreas)
             return oeBppNotSupported;
          if ((Areas[i].Width() & (8 / Areas[i].bpp - 1)) != 0)
             return oeWrongAlignment;
+         if (Areas[i].Width() < 1 || Areas[i].Height() < 1 || Areas[i].Width() > 720 || Areas[i].Height() > 576)
+            return oeWrongAreaSize;
          TotalMemory += Areas[i].Width() * Areas[i].Height() / (8 / Areas[i].bpp);
          }
      if (TotalMemory > osdMem)
diff --git a/osd.h b/osd.h
index 083d0f4a..9156393e 100644
--- a/osd.h
+++ b/osd.h
@@ -4,7 +4,7 @@
  * See the main source file 'vdr.c' for copyright information and
  * how to reach the author.
  *
- * $Id: osd.h 1.49 2005/06/19 10:35:25 kls Exp $
+ * $Id: osd.h 1.50 2005/12/18 12:56:21 kls Exp $
  */
 
 #ifndef __OSD_H
@@ -37,6 +37,7 @@ enum eOsdError { oeOk,
                  oeAreasOverlap,
                  oeWrongAlignment,
                  oeOutOfMemory,
+                 oeWrongAreaSize,
                  oeUnknown,
                };