From e6a383db6f1fb336059c1979b2258dc2c8766c16 Mon Sep 17 00:00:00 2001 From: Lajos Molnar Date: Tue, 3 Feb 2015 14:55:21 -0800 Subject: [PATCH] camera2: limit flexYUV array size in DngCreator corrected overread Bug: 19211135 Change-Id: I373b84dd9e2dc6219a305bf2d0308119668fab2a --- core/java/android/hardware/camera2/DngCreator.java | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/core/java/android/hardware/camera2/DngCreator.java b/core/java/android/hardware/camera2/DngCreator.java index 6fc99ac1b9f6..33d539c25e73 100644 --- a/core/java/android/hardware/camera2/DngCreator.java +++ b/core/java/android/hardware/camera2/DngCreator.java @@ -530,9 +530,9 @@ public final class DngCreator implements AutoCloseable { int uPixStride = uPlane.getPixelStride(); byte[] yuvPixel = { 0, 0, 0 }; - byte[] yFullRow = new byte[yPixStride * width]; - byte[] uFullRow = new byte[uPixStride * width / 2]; - byte[] vFullRow = new byte[vPixStride * width / 2]; + byte[] yFullRow = new byte[yPixStride * (width - 1) + 1]; + byte[] uFullRow = new byte[uPixStride * (width / 2 - 1) + 1]; + byte[] vFullRow = new byte[vPixStride * (width / 2 - 1) + 1]; byte[] finalRow = new byte[BYTES_PER_RGB_PIX * width]; for (int i = 0; i < height; i++) { int halfH = i / 2; -- 2.11.0