Merge "ExifInterface: fix NegativeArraySizeException" am: c57b472d67 am: 582e612fdc (a0f3e642) · Commits · e / os / android_frameworks_base

media/java/android/media/ExifInterface.java

+14 −7

Original line number	Original line	Diff line number	Diff line
	@@ -2198,21 +2198,28 @@ public class ExifInterface {
	dataFormat, numberOfComponents));		dataFormat, numberOfComponents));
	}		}

	if (tag == null \|\| dataFormat <= 0 \|\|		long byteCount = 0;
	dataFormat >= IFD_FORMAT_BYTES_PER_FORMAT.length) {		boolean valid = false;
	// Skip if the parsed tag number is not defined or invalid data format.
	if (tag == null) {		if (tag == null) {
	Log.w(TAG, "Skip the tag entry since tag number is not defined: " + tagNumber);		Log.w(TAG, "Skip the tag entry since tag number is not defined: " + tagNumber);
	} else {		} else if (dataFormat <= 0 \|\| dataFormat >= IFD_FORMAT_BYTES_PER_FORMAT.length) {
	Log.w(TAG, "Skip the tag entry since data format is invalid: " + dataFormat);		Log.w(TAG, "Skip the tag entry since data format is invalid: " + dataFormat);
			} else {
			byteCount = (long) numberOfComponents * IFD_FORMAT_BYTES_PER_FORMAT[dataFormat];
			if (byteCount < 0 \|\| byteCount > Integer.MAX_VALUE) {
			Log.w(TAG, "Skip the tag entry since number of components is invalid: "
			+ numberOfComponents);
			} else {
			valid = true;
			}
	}		}
			if (!valid) {
	dataInputStream.seek(nextEntryOffset);		dataInputStream.seek(nextEntryOffset);
	continue;		continue;
	}		}

	// Read a value from data field or seek to the value offset which is stored in data		// Read a value from data field or seek to the value offset which is stored in data
	// field if the size of the entry value is bigger than 4.		// field if the size of the entry value is bigger than 4.
	int byteCount = numberOfComponents * IFD_FORMAT_BYTES_PER_FORMAT[dataFormat];
	if (byteCount > 4) {		if (byteCount > 4) {
	long offset = dataInputStream.readUnsignedInt();		long offset = dataInputStream.readUnsignedInt();
	if (DEBUG) {		if (DEBUG) {