commit b393a2d9a93e4af4191e8cbf80a4cc4e9c201940
author Eino-Ville Talvala <etalvala@google.com> Tue Apr 28 18:08:50 2020 -0700
committer Eino-Ville Talvala <etalvala@google.com> Wed Apr 29 11:29:04 2020 -0700
tree 43bb6b4174ac76336a2d640cddf6c4a845570e1f
parent 3742d5e5106982da1ae1ad4f38a28efb69e7fe0b

Camera: Validate face count in received metadata

Ensure the count can't cause an overflow in bytes to be read.

Test: atest CtsCameraTestCases; also add bad face count data from camera
  service and manually verify the error logs appear when running
  android.hardware.cts.CameraTest#testFaceDetection.
Bug: 150156131
Change-Id: Ic78ec0ccf67ef8665f80f69aabbb1ae71dd609cd

camera/ICameraClient.cpp

diff --git a/camera/ICameraClient.cpp b/camera/ICameraClient.cpp
index 8620f36..487b8b0 100644
--- a/camera/ICameraClient.cpp
+++ b/camera/ICameraClient.cpp
@@ -143,6 +143,11 @@
             if (data.dataAvail() > 0) {
                 metadata = new camera_frame_metadata_t;
                 metadata->number_of_faces = data.readInt32();
+                if (metadata->number_of_faces <= 0 ||
+                        metadata->number_of_faces > (int32_t)(INT32_MAX / sizeof(camera_face_t))) {
+                    ALOGE("%s: Too large face count: %d", __FUNCTION__, metadata->number_of_faces);
+                    return BAD_VALUE;
+                }
                 metadata->faces = (camera_face_t *) data.readInplace(
                         sizeof(camera_face_t) * metadata->number_of_faces);
             }