Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d2736c84 authored by Flamefire's avatar Flamefire Committed by Danny Baumann
Browse files

Fix crash of gallery on showing details 

The exif parser adds a terminating zero for string values. This increases the
byte count for that entry beyond the set byte count. Causing a null value
in e.g. the "Model" field for images taken with e.g. a Samsung Wave 2.

Change-Id: Ifb6ee4d5b4b71e84cb2a5df459d3716543e25efe
parent fc23aa85

gallerycommon/src/com/android/gallery3d/exif/ExifTag.java

+23 −10
Original line number Diff line number Diff line
@@ -314,10 +314,14 @@ public class ExifTag { 
     * Sets a string value into this tag. This method should be used for tags of

     * type {@link #TYPE_ASCII}. The string is converted to an ASCII string.

     * Characters that cannot be converted are replaced with '?'. The length of

     * the string must be equal to either (component count -1) or (component

     * count). The final byte will be set to the string null terminator '\0',

     * overwriting the last character in the string if the value.length is equal

     * to the component count. This method will fail if:

     * the string must be equal to either

     * <ul>

     * <li>component count - 1 when the terminating '\0' is not present</li>

     * <li>component count when the terminating '\0' is present</li>

     * <li>to comply with some non-conformant implementations, the terminating

     * '\0' will be appended if it's not present and component count equals

     * the string length; the component count will be updated in that case</li>

     * This method will fail if:

     * <ul>

     * <li>The data type is not {@link #TYPE_ASCII} or {@link #TYPE_UNDEFINED}.</li>

     * <li>The length of the string is not equal to (component count - 1) or
@@ -331,12 +335,21 @@ public class ExifTag { 


        byte[] buf = value.getBytes(US_ASCII);

        byte[] finalBuf = buf;

        if (mDataType == TYPE_ASCII) {

            if (buf.length > 0) {

            finalBuf = (buf[buf.length - 1] == 0 || mDataType == TYPE_UNDEFINED) ? buf : Arrays

                .copyOf(buf, buf.length + 1);

        } else if (mDataType == TYPE_ASCII && mComponentCountActual == 1) {

                if (buf[buf.length - 1] != 0) {

                    finalBuf = Arrays.copyOf(buf, buf.length + 1);

                    // Apply the workaround for non conformant implementations

                    // (e.g. Samsung Wave 2): Accept a string with missing

                    // termination character

                    if (mComponentCountActual == buf.length) {

                        mComponentCountActual++;

                    }

                }

            } else if (mComponentCountActual == 1) {

                finalBuf = new byte[] { 0 };

            }

        }

        int count = finalBuf.length;

        if (checkBadComponentCount(count)) {

            return false;