Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 34838352 authored by Eino-Ville Talvala's avatar Eino-Ville Talvala Committed by Automerger Merge Worker
Browse files

Merge "Camera: Validate face count in received metadata" into rvc-dev am: fdb7e3c2 am: 554e4897 

Change-Id: I112b0e5021546d3695292d1d3d3e272f541f5806
parents c9744816 554e4897

camera/ICameraClient.cpp

+5 −0
Original line number Diff line number Diff line
@@ -143,6 +143,11 @@ status_t BnCameraClient::onTransact( 
            if (data.dataAvail() > 0) {

                metadata = new camera_frame_metadata_t;

                metadata->number_of_faces = data.readInt32();

                if (metadata->number_of_faces <= 0 ||

                        metadata->number_of_faces > (int32_t)(INT32_MAX / sizeof(camera_face_t))) {

                    ALOGE("%s: Too large face count: %d", __FUNCTION__, metadata->number_of_faces);

                    return BAD_VALUE;

                }

                metadata->faces = (camera_face_t *) data.readInplace(

                        sizeof(camera_face_t) * metadata->number_of_faces);

            }