Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 27237460 authored by Luca Stefani's avatar Luca Stefani
Browse files

Merge tag 'android-10.0.0_r35' into lineage-17.1-android-10.0.0_r35 

Android 10.0.0 release 35

* tag 'android-10.0.0_r35':
  BnCrypto: fix use-before-init in CREATE_PLUGIN
  Camera: Fix possible ExifUtils heap corruption

Change-Id: I755c73f855236289f323dd66b005c36babeb15d0
parents 3b04f2bc 2b7dc4c1

drm/libmediadrm/ICrypto.cpp

+11 −3
Original line number Diff line number Diff line
@@ -264,8 +264,12 @@ status_t BnCrypto::onTransact( 
        {

            CHECK_INTERFACE(ICrypto, data, reply);



            uint8_t uuid[16];

            data.read(uuid, sizeof(uuid));

            uint8_t uuid[16] = {0};

            if (data.read(uuid, sizeof(uuid)) != NO_ERROR) {

                android_errorWriteLog(0x534e4554, "144767096");

                reply->writeInt32(BAD_VALUE);

                return OK;

            }



            size_t opaqueSize = data.readInt32();

            void *opaqueData = NULL;
@@ -280,7 +284,11 @@ status_t BnCrypto::onTransact( 
                return NO_MEMORY;

            }



            data.read(opaqueData, opaqueSize);

            if (data.read(opaqueData, opaqueSize) != NO_ERROR) {

                android_errorWriteLog(0x534e4554, "144767096");

                reply->writeInt32(BAD_VALUE);

                return OK;

            }

            reply->writeInt32(createPlugin(uuid, opaqueData, opaqueSize));



            free(opaqueData);

services/camera/libcameraservice/utils/ExifUtils.cpp

+2 −2
Original line number Diff line number Diff line
@@ -603,13 +603,13 @@ bool ExifUtilsImpl::setGpsTimestamp(const struct tm& t) { 
}



bool ExifUtilsImpl::setImageHeight(uint32_t length) {

    SET_LONG(EXIF_IFD_0, EXIF_TAG_IMAGE_LENGTH, length);

    SET_SHORT(EXIF_IFD_0, EXIF_TAG_IMAGE_LENGTH, length);

    SET_LONG(EXIF_IFD_EXIF, EXIF_TAG_PIXEL_Y_DIMENSION, length);

    return true;

}



bool ExifUtilsImpl::setImageWidth(uint32_t width) {

    SET_LONG(EXIF_IFD_0, EXIF_TAG_IMAGE_WIDTH, width);

    SET_SHORT(EXIF_IFD_0, EXIF_TAG_IMAGE_WIDTH, width);

    SET_LONG(EXIF_IFD_EXIF, EXIF_TAG_PIXEL_X_DIMENSION, width);

    return true;

}