This avoids crashes when initializing the range coder for
the first slice context.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
int i;
f->slice_count = f->num_h_slices * f->num_v_slices;
+ if (f->slice_count <= 0) {
+ av_log(f->avctx, AV_LOG_ERROR, "Invalid number of slices\n");
+ return AVERROR(EINVAL);
+ }
for (i = 0; i < f->slice_count; i++) {
FFV1Context *fs = av_mallocz(sizeof(*fs));