From 9ccd8899ff28c4f6bdd113026d307af3d46133c5 Mon Sep 17 00:00:00 2001
From: Steve Williams <lompikvoila@gmail.com>
Date: Mon, 2 Feb 2026 16:02:23 +0400
Subject: [PATCH] sub/draw_bmp: limit memset to available width in last slice

extends f3c1dcf7a13c61deb6bcdeeaec9f82163ab31177 for all lines not just
the last. This avoid unnecessary write every line and fixes a buffer
overflow for small enough images (for example 78x64).
---
 sub/draw_bmp.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sub/draw_bmp.c b/sub/draw_bmp.c
index 4aa59976a9..9c22fdff31 100644
--- a/sub/draw_bmp.c
+++ b/sub/draw_bmp.c
@@ -485,9 +485,9 @@ static void clear_rgba_overlay(struct mp_draw_sub_cache *p)
         for (int sx = 0; sx < p->s_w; sx++) {
             struct slice *s = &line[sx];
 
-            // Ensure this final slice doesn't extend beyond the width of p->s_w
-            if (s->x1 == SLICE_W && sx == p->s_w - 1 && y == p->rgba_overlay->h - 1)
-                s->x1 = MPMIN(p->w - ((p->s_w - 1) * SLICE_W), s->x1);
+            // Ensure the last slice doesn't extend beyond the total width.
+            if (sx == p->s_w - 1)
+                s->x1 = MPMIN(p->w - (sx * SLICE_W), s->x1);
 
             if (s->x0 <= s->x1) {
                 memset(px + s->x0, 0, (s->x1 - s->x0) * 4);