From df9ea6e6792ded9d909fe16cc2acb33d2064890e Mon Sep 17 00:00:00 2001 From: Ravneet Dhanjal Date: Wed, 4 Jan 2023 21:06:52 +0000 Subject: [PATCH] Validate request metadata before coverting to camera metadata - Backport similar fix from AIDL to HIDL to protect from malformed metadata Bug: 256166626 Test: CTS test Change-Id: If8f83520144824e38ed102b7468d6d5ee2e6d963 --- camera/device/3.2/default/convert.cpp | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/camera/device/3.2/default/convert.cpp b/camera/device/3.2/default/convert.cpp index 06ad7e963c..207560783f 100644 --- a/camera/device/3.2/default/convert.cpp +++ b/camera/device/3.2/default/convert.cpp @@ -16,6 +16,7 @@ #define LOG_TAG "android.hardware.camera.device@3.2-convert-impl" #include +#include #include "include/convert.h" @@ -43,6 +44,13 @@ bool convertFromHidl(const CameraMetadata &src, const camera_metadata_t** dst) { ALOGE("%s: input CameraMetadata is corrupt!", __FUNCTION__); return false; } + + if (validate_camera_metadata_structure((camera_metadata_t*)data, /*expected_size=*/NULL) != + OK) { + ALOGE("%s: Failed to validate the metadata structure", __FUNCTION__); + return false; + } + *dst = (camera_metadata_t*) data; return true; }