dvbsubdec: Free subrect memory on allocation error

Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>

libavcodec/dvbsubdec.c

@@ -1293,6 +1293,10 @@ static int dvbsub_display_end_segment(AVCodecContext *avctx, const uint8_t *buf,
         for (i = 0; i < sub->num_rects; i++) {
             sub->rects[i] = av_mallocz(sizeof(*sub->rects[i]));
             if (!sub->rects[i]) {
+                int j;
+                for (j = 0; j < i; j ++)
+                    av_free(sub->rects[j]);
+                av_free(sub->rects);
                 return AVERROR(ENOMEM);
             }
         }
@@ -1335,6 +1339,8 @@ static int dvbsub_display_end_segment(AVCodecContext *avctx, const uint8_t *buf,
 
         rect->data[1] = av_mallocz(AVPALETTE_SIZE);
         if (!rect->data[1]) {
+            for (i = 0; i < sub->num_rects; i++)
+                av_free(sub->rects[i]);
             av_free(sub->rects);
             return AVERROR(ENOMEM);
         }
@@ -1343,6 +1349,8 @@ static int dvbsub_display_end_segment(AVCodecContext *avctx, const uint8_t *buf,
         rect->data[0] = av_malloc(region->buf_size);
         if (!rect->data[0]) {
             av_free(rect->data[1]);
+            for (i = 0; i < sub->num_rects; i++)
+                av_free(sub->rects[i]);
             av_free(sub->rects);
             return AVERROR(ENOMEM);
         }