diff options
authorEmilian Peev <>2016-01-07 19:14:45 (GMT)
committerDaniel Hillenbrand <>2016-01-07 19:40:00 (GMT)
commit707bdfd17f5e056fbea8fd3e0f4f15cd8fb39960 (patch)
parent735ba518afd8b8e7d2f76dcc9e5ec6415c708472 (diff)
SnapdragonCamera: Correct AutoHDR callback data size check
Currently the AutoHDR functionality which handles metadata callbacks always assumes that the length of the callback data buffer will be equal to 12 bytes. It will always try to read and convert 3 32-bit integers. The check before this processing is incorrect as it allows buffers which are less than 12 bytes to be processed as well. This can lead to array out of bounds exceptions, which are also possible during FD snapshot metadata callbacks that don't contain any faces. In this particular scenario the metadata callback buffer size will be 8 bytes. Change-Id: I4094aaa56aa4135d2d806861353d49c8d7f9985c CRs-Fixed: 799110
1 files changed, 1 insertions, 1 deletions
diff --git a/src/com/android/camera/ b/src/com/android/camera/
index 44f375e..7886323 100644
--- a/src/com/android/camera/
+++ b/src/com/android/camera/
@@ -1059,7 +1059,7 @@ public class PhotoModule
public void onCameraMetaData (byte[] data, android.hardware.Camera camera) {
int metadata[] = new int[3];
- if (data.length <= 12) {
+ if (data.length >= 12) {
for (int i =0;i<3;i++) {
metadata[i] = byteToInt( (byte []) data, i*4);