diff options
author | Eino-Ville Talvala <etalvala@google.com> | 2016-08-16 15:48:05 -0700 |
---|---|---|
committer | Jessica Wagantall <jwagantall@cyngn.com> | 2016-10-04 16:10:24 -0700 |
commit | 27017539bdb3521394c91063b6ffd3632546e9d7 (patch) | |
tree | f2acb59036d84887efc9472b8dfbf98c774dc391 | |
parent | a8fa67b0a11339b75ec8942ded293f3a872515d8 (diff) | |
download | android_system_media-stable/cm-13.0-ZNH2KB.tar.gz android_system_media-stable/cm-13.0-ZNH2KB.tar.bz2 android_system_media-stable/cm-13.0-ZNH2KB.zip |
Camera metadata: Check for inconsistent data countstable/cm-13.0-ZNH2KB
Also check for overflow of data/entry count on append.
CYNGNOS-3286
Bug: 30591838
(Cherry-pick from Change-Id: Ibf4c3c6e236cdb28234f3125055d95ef0a2416a2)
Change-Id: I1b9bd51bc3add785d3b9feb48acb999bafca3388
(cherry picked from commit 5c647bbd6b91aba02b063206aa12f108e0756022)
(cherry picked from commit 35872f067f8f6459cecf06c8918e7aa0a651b63f)
-rw-r--r-- | camera/src/camera_metadata.c | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/camera/src/camera_metadata.c b/camera/src/camera_metadata.c index 9bb58cb7..99277f73 100644 --- a/camera/src/camera_metadata.c +++ b/camera/src/camera_metadata.c @@ -13,7 +13,7 @@ * See the License for the specific language governing permissions and * limitations under the License. */ - +#define _GNU_SOURCE // for fdprintf #include <inttypes.h> #include <system/camera_metadata.h> #include <camera_metadata_hidden.h> @@ -390,6 +390,14 @@ int validate_camera_metadata_structure(const camera_metadata_t *metadata, return ERROR; } + if (metadata->data_count > metadata->data_capacity) { + ALOGE("%s: Data count (%" PRIu32 ") should be <= data capacity " + "(%" PRIu32 ")", + __FUNCTION__, metadata->data_count, metadata->data_capacity); + android_errorWriteLog(SN_EVENT_LOG_ID, "30591838"); + return ERROR; + } + const metadata_uptrdiff_t entries_end = metadata->entries_start + metadata->entry_capacity; if (entries_end < metadata->entries_start || // overflow check @@ -496,6 +504,10 @@ int append_camera_metadata(camera_metadata_t *dst, const camera_metadata_t *src) { if (dst == NULL || src == NULL ) return ERROR; + // Check for overflow + if (src->entry_count + dst->entry_count < src->entry_count) return ERROR; + if (src->data_count + dst->data_count < src->data_count) return ERROR; + // Check for space if (dst->entry_capacity < src->entry_count + dst->entry_count) return ERROR; if (dst->data_capacity < src->data_count + dst->data_count) return ERROR; |