Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e6d7b44f authored by Quallenauge's avatar Quallenauge Committed by Łukasz Patron
Browse files

Camera: Handle 0 faces count in received metadata 

The goal of previously introduced changes for
validation of face count was to avoid buffer overflows.

0 is a special value, which should be handled as valid,
since no data is allocated in this case.

Change-Id: I1413ac8d12a337ad43abdffb7676c6f7d90cd785
parent 1dab634d

camera/ICameraClient.cpp

+1 −1
Original line number Diff line number Diff line
@@ -151,7 +151,7 @@ status_t BnCameraClient::onTransact( 
            camera_frame_metadata_t metadata;

            if (data.dataAvail() > 0) {

                metadata.number_of_faces = data.readInt32();

                if (metadata.number_of_faces <= 0 ||

                if (metadata.number_of_faces < 0 ||

                        metadata.number_of_faces > (int32_t)(INT32_MAX / sizeof(camera_face_t))) {

                    ALOGE("%s: Too large face count: %d", __FUNCTION__, metadata.number_of_faces);

                    return BAD_VALUE;