commit f4481c4d980e5a8c62c2d1351efc2ee89d492190
author Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Wed Mar 04 18:16:17 2020 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Wed Mar 04 18:16:17 2020 +0000
tree 392a2735d6cbb17c75369c8f740b42b6b0c685b4
parent 500fd41fd5a3dd8141be54e541931cca2ee0c465
parent 711ebe64dd064a631aa3001fc914c333efed33aa

Camera: Fix possible ExifUtils heap corruption am: aa5673385a am: 711ebe64dd

Change-Id: I4a423ed76e117f2809aeed53a5ce1ba4d6919fdc

camera/common/1.0/default/Exif.cpp

diff --git a/camera/common/1.0/default/Exif.cpp b/camera/common/1.0/default/Exif.cpp
index 4de05c5..413b6bb 100644
--- a/camera/common/1.0/default/Exif.cpp
+++ b/camera/common/1.0/default/Exif.cpp
@@ -632,13 +632,13 @@
 }
 
 bool ExifUtilsImpl::setImageHeight(uint32_t length) {
-    SET_LONG(EXIF_IFD_0, EXIF_TAG_IMAGE_LENGTH, length);
+    SET_SHORT(EXIF_IFD_0, EXIF_TAG_IMAGE_LENGTH, length);
     SET_LONG(EXIF_IFD_EXIF, EXIF_TAG_PIXEL_Y_DIMENSION, length);
     return true;
 }
 
 bool ExifUtilsImpl::setImageWidth(uint32_t width) {
-    SET_LONG(EXIF_IFD_0, EXIF_TAG_IMAGE_WIDTH, width);
+    SET_SHORT(EXIF_IFD_0, EXIF_TAG_IMAGE_WIDTH, width);
     SET_LONG(EXIF_IFD_EXIF, EXIF_TAG_PIXEL_X_DIMENSION, width);
     return true;
 }