Fix UAF error in CameraModule.
Bug: 22542551
Change-Id: I2fe5791a6554a8e2f7fd94593d552d8af18257db
diff --git a/services/camera/libcameraservice/common/CameraModule.cpp b/services/camera/libcameraservice/common/CameraModule.cpp
index 1ae01ae..6a4dfe0 100644
--- a/services/camera/libcameraservice/common/CameraModule.cpp
+++ b/services/camera/libcameraservice/common/CameraModule.cpp
@@ -136,9 +136,10 @@
// Always add a default for the pre-correction active array if the vendor chooses to omit this
camera_metadata_entry entry = chars.find(ANDROID_SENSOR_INFO_PRE_CORRECTION_ACTIVE_ARRAY_SIZE);
if (entry.count == 0) {
+ Vector<int32_t> preCorrectionArray;
entry = chars.find(ANDROID_SENSOR_INFO_ACTIVE_ARRAY_SIZE);
- chars.update(ANDROID_SENSOR_INFO_PRE_CORRECTION_ACTIVE_ARRAY_SIZE, entry.data.i32,
- entry.count);
+ preCorrectionArray.appendArray(entry.data.i32, entry.count);
+ chars.update(ANDROID_SENSOR_INFO_PRE_CORRECTION_ACTIVE_ARRAY_SIZE, preCorrectionArray);
}
return;