Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "ExifInterface: fix NegativeArraySizeException" am: c57b472d67 am: 582e612fdc

Browse Source 
am: 52dd278eb3

Change-Id: I511eb25ec5124d989889fcf9da33a167eed63bcd
This commit is contained in:
Sungsoo Lim
2016-12-05 04:54:35 +00:00
committed by android-build-merger
parent ae68a5cb29 52dd278eb3
commit a0f3e642a4
1 changed files with 14 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
media/java/android/media/ExifInterface.java
View File

@@ -2198,21 +2198,28 @@ public class ExifInterface {
dataFormat, numberOfComponents)); dataFormat, numberOfComponents));
} }
if (tag == null || dataFormat <= 0 || long byteCount = 0;
dataFormat >= IFD_FORMAT_BYTES_PER_FORMAT.length) { boolean valid = false;
// Skip if the parsed tag number is not defined or invalid data format. if (tag == null) {
if (tag == null) { Log.w(TAG, "Skip the tag entry since tag number is not defined: " + tagNumber);
Log.w(TAG, "Skip the tag entry since tag number is not defined: " + tagNumber); } else if (dataFormat <= 0 || dataFormat >= IFD_FORMAT_BYTES_PER_FORMAT.length) {
Log.w(TAG, "Skip the tag entry since data format is invalid: " + dataFormat);
} else {
byteCount = (long) numberOfComponents * IFD_FORMAT_BYTES_PER_FORMAT[dataFormat];
if (byteCount < 0 || byteCount > Integer.MAX_VALUE) {
Log.w(TAG, "Skip the tag entry since number of components is invalid: "
+ numberOfComponents);
} else { } else {
Log.w(TAG, "Skip the tag entry since data format is invalid: " + dataFormat); valid = true;
} }
}
if (!valid) {
dataInputStream.seek(nextEntryOffset); dataInputStream.seek(nextEntryOffset);
continue; continue;
} }
// Read a value from data field or seek to the value offset which is stored in data // Read a value from data field or seek to the value offset which is stored in data
// field if the size of the entry value is bigger than 4. // field if the size of the entry value is bigger than 4.
int byteCount = numberOfComponents * IFD_FORMAT_BYTES_PER_FORMAT[dataFormat];
if (byteCount > 4) { if (byteCount > 4) {
long offset = dataInputStream.readUnsignedInt(); long offset = dataInputStream.readUnsignedInt();
if (DEBUG) { if (DEBUG) {