commit d8ebb625a77c908e3703f4f1afcb652122e641ac
author Eino-Ville Talvala <etalvala@google.com> Tue Aug 16 15:48:05 2016 -0700
committer Feng Yu <feny@google.com> Tue Aug 23 23:05:52 2016 +0000
tree 07bcae33be17f2f019ec5e25c36f7ceac2d0931d
parent dce0eca34eab2016d6d11cb32f072db4079a4461

Camera metadata: Check for inconsistent data count

Also check for overflow of data/entry count on append.

Bug: 30591838
Change-Id: Ibf4c3c6e236cdb28234f3125055d95ef0a2416a2

camera/src/camera_metadata.c

diff --git a/camera/src/camera_metadata.c b/camera/src/camera_metadata.c
index eb914eb..8ba870f 100644
--- a/camera/src/camera_metadata.c
+++ b/camera/src/camera_metadata.c
@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-
+#define _GNU_SOURCE // for fdprintf
 #include <inttypes.h>
 #include <system/camera_metadata.h>
 #include <camera_metadata_hidden.h>
@@ -359,14 +359,11 @@
 
     const metadata_uptrdiff_t entries_end =
         metadata->entries_start + metadata->entry_capacity;
-    if (entries_end < metadata->entries_start || // overflow check
-        entries_end > metadata->data_start) {
-
-        ALOGE("%s: Entry start + capacity (%" PRIu32 ") should be <= data start "
+    if (metadata->data_count > metadata->data_capacity) {
+        ALOGE("%s: Data count (%" PRIu32 ") should be <= data capacity "
               "(%" PRIu32 ")",
-               __FUNCTION__,
-              (metadata->entries_start + metadata->entry_capacity),
-              metadata->data_start);
+              __FUNCTION__, metadata->data_count, metadata->data_capacity);
+        android_errorWriteLog(SN_EVENT_LOG_ID, "30591838");
         return ERROR;
     }
 
@@ -459,6 +456,10 @@
         const camera_metadata_t *src) {
     if (dst == NULL || src == NULL ) return ERROR;
 
+    // Check for overflow
+    if (src->entry_count + dst->entry_count < src->entry_count) return ERROR;
+    if (src->data_count + dst->data_count < src->data_count) return ERROR;
+    // Check for space
     if (dst->entry_capacity < src->entry_count + dst->entry_count) return ERROR;
     if (dst->data_capacity < src->data_count + dst->data_count) return ERROR;