diff options
| author | Emilian Peev <epeevs@codeaurora.org> | 2015-02-25 15:58:04 +0200 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2015-03-25 23:59:55 -0700 |
| commit | 1d9d56f177d115e33d194566f3fb862ce6fb2d44 (patch) | |
| tree | bb579694374c19c078a285d678fa3d526c58f3cd /src | |
| parent | 10e898a87b0812781578c73a20ec4f6164580d03 (diff) | |
| download | android_packages_apps_Snap-1d9d56f177d115e33d194566f3fb862ce6fb2d44.tar.gz android_packages_apps_Snap-1d9d56f177d115e33d194566f3fb862ce6fb2d44.tar.bz2 android_packages_apps_Snap-1d9d56f177d115e33d194566f3fb862ce6fb2d44.zip | |
SnapdragonCamera: Correct AutoHDR callback data size check
Currently the AutoHDR functionality which handles
metadata callbacks always assumes that the length
of the callback data buffer will be equal to 12
bytes. It will always try to read and convert 3
32-bit integers. The check before this processing
is incorrect as it allows buffers which are less
than 12 bytes to be processed as well. This can
lead to array out of bounds exceptions, which are
also possible during FD snapshot metadata
callbacks that don't contain any faces. In this
particular scenario the metadata callback buffer
size will be 8 bytes.
Change-Id: I4094aaa56aa4135d2d806861353d49c8d7f9985c
CRs-Fixed: 799110
Diffstat (limited to 'src')
| -rw-r--r-- | src/com/android/camera/PhotoModule.java | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/com/android/camera/PhotoModule.java b/src/com/android/camera/PhotoModule.java index 3361187f6..5d7212a11 100644 --- a/src/com/android/camera/PhotoModule.java +++ b/src/com/android/camera/PhotoModule.java @@ -1040,7 +1040,7 @@ public class PhotoModule @Override public void onCameraMetaData (byte[] data, android.hardware.Camera camera) { int metadata[] = new int[3]; - if (data.length <= 12) { + if (data.length >= 12) { for (int i =0;i<3;i++) { metadata[i] = byteToInt( (byte []) data, i*4); } |