From 269085e79c88ad7cb868a8eae8f74089645dd7d7 Mon Sep 17 00:00:00 2001
From: Flamefire <alex@grundis.de>
Date: Sun, 24 Aug 2014 16:26:09 +0200
Subject: Gallery2: Fix crash of gallery on showing details

The exif parser adds a terminating zero for string values. This increases the
byte count for that entry beyond the set byte count. Causing a null value
in e.g. the "Model" field for images taken with e.g. a Samsung Wave 2.

Change-Id: Ib781d9262dbffb610686c939dad94a6cf4c17727
---
 .../src/com/android/gallery3d/exif/ExifTag.java    | 33 +++++++++++++++-------
 1 file changed, 23 insertions(+), 10 deletions(-)

diff --git a/gallerycommon/src/com/android/gallery3d/exif/ExifTag.java b/gallerycommon/src/com/android/gallery3d/exif/ExifTag.java
index b8b387201..c30a97143 100644
--- a/gallerycommon/src/com/android/gallery3d/exif/ExifTag.java
+++ b/gallerycommon/src/com/android/gallery3d/exif/ExifTag.java
@@ -314,13 +314,17 @@ public class ExifTag {
      * Sets a string value into this tag. This method should be used for tags of
      * type {@link #TYPE_ASCII}. The string is converted to an ASCII string.
      * Characters that cannot be converted are replaced with '?'. The length of
-     * the string must be equal to either (component count -1) or (component
-     * count). The final byte will be set to the string null terminator '\0',
-     * overwriting the last character in the string if the value.length is equal
-     * to the component count. This method will fail if:
+     * the string must be equal to either
+     * <ul>
+     * <li>component count - 1 when the terminating '\0' is not present</li>
+     * <li>component count when the terminating '\0' is present</li>
+     * <li>to comply with some non-conformant implementations, the terminating
+     * '\0' will be appended if it's not present and component count equals
+     * the string length; the component count will be updated in that case</li>
+     * This method will fail if:
      * <ul>
      * <li>The data type is not {@link #TYPE_ASCII} or {@link #TYPE_UNDEFINED}.</li>
-     * <li>The length of the string is not equal to (component count -1) or
+     * <li>The length of the string is not equal to (component count - 1) or
      * (component count) in the definition for this tag.</li>
      * </ul>
      */
@@ -331,11 +335,20 @@ public class ExifTag {
 
         byte[] buf = value.getBytes(US_ASCII);
         byte[] finalBuf = buf;
-        if (buf.length > 0) {
-            finalBuf = (buf[buf.length - 1] == 0 || mDataType == TYPE_UNDEFINED) ? buf : Arrays
-                .copyOf(buf, buf.length + 1);
-        } else if (mDataType == TYPE_ASCII && mComponentCountActual == 1) {
-            finalBuf = new byte[] { 0 };
+        if (mDataType == TYPE_ASCII) {
+            if (buf.length > 0) {
+                if (buf[buf.length - 1] != 0) {
+                    finalBuf = Arrays.copyOf(buf, buf.length + 1);
+                    // Apply the workaround for non conformant implementations
+                    // (e.g. Samsung Wave 2): Accept a string with missing
+                    // termination character
+                    if (mComponentCountActual == buf.length) {
+                        mComponentCountActual++;
+                    }
+                }
+            } else if (mComponentCountActual == 1) {
+                finalBuf = new byte[] { 0 };
+            }
         }
         int count = finalBuf.length;
         if (checkBadComponentCount(count)) {
-- 
cgit v1.2.3