diff options
| author | Daniel Levin <dendy@ti.com> | 2012-02-03 22:14:29 +0200 |
|---|---|---|
| committer | Daniel Levin <dendy@ti.com> | 2012-07-25 08:55:39 -0500 |
| commit | 0b63d71be070036363c89553efc196a62de0d756 (patch) | |
| tree | 169771e1f02927f5aeccbd70bac6806da07958ea | |
| parent | ff5a592e57cf5736dda07163a7d376aeb5e38e2c (diff) | |
| download | hardware_ti_omap4-0b63d71be070036363c89553efc196a62de0d756.zip hardware_ti_omap4-0b63d71be070036363c89553efc196a62de0d756.tar.gz hardware_ti_omap4-0b63d71be070036363c89553efc196a62de0d756.tar.bz2 | |
CameraHAL: Fixed memory corruption while JPEG encoding
In case image frame width is greater than stride/2
the right_crop offset gets negative and conversion to YUV
will write outside of allocated memory.
Signed-off-by: Daniel Levin <dendy@ti.com>
Change-Id: I87532ea02ade3636a752954d09f4a9cbdea5ffc3
| -rw-r--r-- | camera/Encoder_libjpeg.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/camera/Encoder_libjpeg.cpp b/camera/Encoder_libjpeg.cpp index deed61a..d4eca43 100644 --- a/camera/Encoder_libjpeg.cpp +++ b/camera/Encoder_libjpeg.cpp @@ -421,7 +421,7 @@ size_t Encoder_libjpeg::encode(params* input) { jpeg_start_compress(&cinfo, TRUE); - row_tmp = (uint8_t*)malloc(out_width * 3); + row_tmp = (uint8_t*)malloc((out_width - right_crop) * 3); row_src = src + start_offset; row_uv = src + out_width * out_height * bpp; |