Camera: Fix possible ExifUtils heap corruption

Both EXIF_TAG_IMAGE_WIDTH and EXIF_TAG_IMAGE_LENGTH
expect short values as per EXIF spec. Call appropriate
libexif function to avoid possible heap corruption.

Bug: 148223871
Test: run sts-engbuild-no-spl-lock -m StsHostTestCases --test android.security.sts.Poc20_02#testPocBug_148223871
Change-Id: I57a774454b52c16d7da9f90d7e3a3407294606a5
gugelfrei
Emilian Peev 4 years ago
parent cadf7289e0
commit 649a27ad16

@ -603,13 +603,13 @@ bool ExifUtilsImpl::setGpsTimestamp(const struct tm& t) {
}
bool ExifUtilsImpl::setImageHeight(uint32_t length) {
SET_LONG(EXIF_IFD_0, EXIF_TAG_IMAGE_LENGTH, length);
SET_SHORT(EXIF_IFD_0, EXIF_TAG_IMAGE_LENGTH, length);
SET_LONG(EXIF_IFD_EXIF, EXIF_TAG_PIXEL_Y_DIMENSION, length);
return true;
}
bool ExifUtilsImpl::setImageWidth(uint32_t width) {
SET_LONG(EXIF_IFD_0, EXIF_TAG_IMAGE_WIDTH, width);
SET_SHORT(EXIF_IFD_0, EXIF_TAG_IMAGE_WIDTH, width);
SET_LONG(EXIF_IFD_EXIF, EXIF_TAG_PIXEL_X_DIMENSION, width);
return true;
}

Loading…
Cancel
Save