Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fdb2112b authored by Lajos Molnar's avatar Lajos Molnar
Browse files

camera2: limit flexYUV array size in DngCreator 

corrected overread

Bug: 19211135
Change-Id: I373b84dd9e2dc6219a305bf2d0308119668fab2a
parent 39ae0547

core/java/android/hardware/camera2/DngCreator.java

+3 −3
Original line number Diff line number Diff line
@@ -530,9 +530,9 @@ public final class DngCreator implements AutoCloseable { 
        int uPixStride = uPlane.getPixelStride();



        byte[] yuvPixel = { 0, 0, 0 };

        byte[] yFullRow = new byte[yPixStride * width];

        byte[] uFullRow = new byte[uPixStride * width / 2];

        byte[] vFullRow = new byte[vPixStride * width / 2];

        byte[] yFullRow = new byte[yPixStride * (width - 1) + 1];

        byte[] uFullRow = new byte[uPixStride * (width / 2 - 1) + 1];

        byte[] vFullRow = new byte[vPixStride * (width / 2 - 1) + 1];

        byte[] finalRow = new byte[BYTES_PER_RGB_PIX * width];

        for (int i = 0; i < height; i++) {

            int halfH = i / 2;