SnapdragonCamera: Correct AutoHDR callback data size check

 Currently the AutoHDR functionality which handles
 metadata callbacks always assumes that the length
 of the callback data buffer will be equal to 12
 bytes. It will always try to read and convert 3
 32-bit integers. The check before this processing
 is incorrect as it allows buffers which are less
 than 12 bytes to be processed as well. This can
 lead to array out of bounds exceptions, which are
 also possible during FD snapshot metadata
 callbacks that don't contain any faces. In this
 particular scenario the metadata callback buffer
 size will be 8 bytes.

Change-Id: I4094aaa56aa4135d2d806861353d49c8d7f9985c
CRs-Fixed: 799110

1 files changed, 1 insertions, 1 deletions

diff --git a/src/com/android/camera/PhotoModule.java b/src/com/android/camera/PhotoModule.java
index 44f375e3a..78863230d 100644
--- a/src/com/android/camera/PhotoModule.java
+++ b/src/com/android/camera/PhotoModule.java
@@ -1059,7 +1059,7 @@ public class PhotoModule
         @Override
         public void onCameraMetaData (byte[] data, android.hardware.Camera camera) {
             int metadata[] = new int[3];
-            if (data.length <= 12) {
+            if (data.length >= 12) {
                 for (int i =0;i<3;i++) {
                     metadata[i] = byteToInt( (byte []) data, i*4);
                 }