From 60217b5b9cf713b1eeb7626473eac357cde25673 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michaelni@gmx.at>
Date: Wed, 25 Apr 2012 15:01:32 +0200
Subject: [PATCH] ffv1: Remove slice count field with 1.3 and just count
 slices.

This field was problematic because in case of damaged slices it can be
lost

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
---
 libavcodec/ffv1.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/libavcodec/ffv1.c b/libavcodec/ffv1.c
index fc68c8ca28..c31c3ff51e 100644
--- a/libavcodec/ffv1.c
+++ b/libavcodec/ffv1.c
@@ -660,9 +660,8 @@ static void write_header(FFV1Context *f){
         put_rac(c, state, f->transparency);
 
         write_quant_tables(c, f->quant_table);
-    }else{
+    }else if(f->version < 3){
         put_symbol(c, state, f->slice_count, 0);
-        if(f->version < 3){
         for(i=0; i<f->slice_count; i++){
             FFV1Context *fs= f->slice_context[i];
             put_symbol(c, state, (fs->slice_x     +1)*f->num_h_slices / f->width   , 0);
@@ -674,7 +673,6 @@ static void write_header(FFV1Context *f){
                 av_assert0(f->plane[j].quant_table_index == f->avctx->context_model);
             }
         }
-        }
     }
 }
 #endif /* CONFIG_FFV1_ENCODER */
@@ -1862,10 +1860,21 @@ static int read_header(FFV1Context *f){
                 av_log(f->avctx, AV_LOG_ERROR, "read_quant_table error\n");
                 return -1;
         }
-    }else{
+    }else if(f->version < 3){
         f->slice_count= get_symbol(c, state, 0);
-        if(f->slice_count > (unsigned)MAX_SLICES)
-            return -1;
+    }else{
+        const uint8_t *p= c->bytestream_end;
+        for(f->slice_count = 0; f->slice_count < MAX_SLICES && 3 < p - c->bytestream_start; f->slice_count++){
+            int trailer = 3 + 5*!!f->ec;
+            int size = AV_RB24(p-trailer);
+            if(size + trailer > p - c->bytestream_start)
+                break;
+            p -= size + trailer;
+        }
+    }
+    if(f->slice_count > (unsigned)MAX_SLICES || f->slice_count <= 0){
+        av_log(f->avctx, AV_LOG_ERROR, "slice count %d is invalid\n", f->slice_count);
+        return -1;
     }
 
     for(j=0; j<f->slice_count; j++){