Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit aa567338 authored by Emilian Peev's avatar Emilian Peev
Browse files

Camera: Fix possible ExifUtils heap corruption 

Both EXIF_TAG_IMAGE_WIDTH and EXIF_TAG_IMAGE_LENGTH
expect short values as per EXIF spec. Call appropriate
libexif function to avoid possible heap corruption.

Bug: 148223871
Test: Successful build
Change-Id: Ib16bf1ae8ab2093da529efe6ff0778331c3e9eb3
parent 984b3069

camera/common/1.0/default/Exif.cpp

+2 −2
Original line number Diff line number Diff line
@@ -632,13 +632,13 @@ bool ExifUtilsImpl::setGpsTimestamp(const struct tm& t) { 
}



bool ExifUtilsImpl::setImageHeight(uint32_t length) {

    SET_LONG(EXIF_IFD_0, EXIF_TAG_IMAGE_LENGTH, length);

    SET_SHORT(EXIF_IFD_0, EXIF_TAG_IMAGE_LENGTH, length);

    SET_LONG(EXIF_IFD_EXIF, EXIF_TAG_PIXEL_Y_DIMENSION, length);

    return true;

}



bool ExifUtilsImpl::setImageWidth(uint32_t width) {

    SET_LONG(EXIF_IFD_0, EXIF_TAG_IMAGE_WIDTH, width);

    SET_SHORT(EXIF_IFD_0, EXIF_TAG_IMAGE_WIDTH, width);

    SET_LONG(EXIF_IFD_EXIF, EXIF_TAG_PIXEL_X_DIMENSION, width);

    return true;

}