summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorEmilian Peev <epeevs@codeaurora.org>2016-01-07 19:14:45 (GMT)
committerDaniel Hillenbrand <codeworkx@cyanogenmod.org>2016-01-07 19:40:00 (GMT)
commit707bdfd17f5e056fbea8fd3e0f4f15cd8fb39960 (patch)
tree3b2403c1a2f555611605d6dba328de83eec3b041
parent735ba518afd8b8e7d2f76dcc9e5ec6415c708472 (diff)
downloadandroid_packages_apps_Snap-707bdfd17f5e056fbea8fd3e0f4f15cd8fb39960.zip
android_packages_apps_Snap-707bdfd17f5e056fbea8fd3e0f4f15cd8fb39960.tar.gz
android_packages_apps_Snap-707bdfd17f5e056fbea8fd3e0f4f15cd8fb39960.tar.bz2
SnapdragonCamera: Correct AutoHDR callback data size check
Currently the AutoHDR functionality which handles metadata callbacks always assumes that the length of the callback data buffer will be equal to 12 bytes. It will always try to read and convert 3 32-bit integers. The check before this processing is incorrect as it allows buffers which are less than 12 bytes to be processed as well. This can lead to array out of bounds exceptions, which are also possible during FD snapshot metadata callbacks that don't contain any faces. In this particular scenario the metadata callback buffer size will be 8 bytes. Change-Id: I4094aaa56aa4135d2d806861353d49c8d7f9985c CRs-Fixed: 799110
-rw-r--r--src/com/android/camera/PhotoModule.java2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/com/android/camera/PhotoModule.java b/src/com/android/camera/PhotoModule.java
index 44f375e..7886323 100644
--- a/src/com/android/camera/PhotoModule.java
+++ b/src/com/android/camera/PhotoModule.java
@@ -1059,7 +1059,7 @@ public class PhotoModule
@Override
public void onCameraMetaData (byte[] data, android.hardware.Camera camera) {
int metadata[] = new int[3];
- if (data.length <= 12) {
+ if (data.length >= 12) {
for (int i =0;i<3;i++) {
metadata[i] = byteToInt( (byte []) data, i*4);
}