From aa822007a4bb7a8855fee66af25d99bf5bddac23 Mon Sep 17 00:00:00 2001
From: Limin Wang <lance.lmwang@gmail.com>
Date: Wed, 25 Mar 2020 18:45:47 +0800
Subject: [PATCH] avfilter/vf_showinfo: check if the s12m data size is valid

Signed-off-by: Limin Wang <lance.lmwang@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/vf_showinfo.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavfilter/vf_showinfo.c b/libavfilter/vf_showinfo.c
index 79b79db2d3..71534d1fa8 100644
--- a/libavfilter/vf_showinfo.c
+++ b/libavfilter/vf_showinfo.c
@@ -318,6 +318,10 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *frame)
             break;
         case AV_FRAME_DATA_S12M_TIMECODE: {
             uint32_t *tc = (uint32_t*)sd->data;
+            if (sd->size != 16) {
+                av_log(ctx, AV_LOG_ERROR, "invalid data");
+                break;
+            }
             for (int j = 1; j <= tc[0]; j++) {
                 char tcbuf[AV_TIMECODE_STR_SIZE];
                 av_timecode_make_smpte_tc_string(tcbuf, tc[j], 0);