From 0b63d71be070036363c89553efc196a62de0d756 Mon Sep 17 00:00:00 2001 From: Daniel Levin Date: Fri, 3 Feb 2012 22:14:29 +0200 Subject: CameraHAL: Fixed memory corruption while JPEG encoding In case image frame width is greater than stride/2 the right_crop offset gets negative and conversion to YUV will write outside of allocated memory. Signed-off-by: Daniel Levin Change-Id: I87532ea02ade3636a752954d09f4a9cbdea5ffc3 --- camera/Encoder_libjpeg.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/camera/Encoder_libjpeg.cpp b/camera/Encoder_libjpeg.cpp index deed61a..d4eca43 100644 --- a/camera/Encoder_libjpeg.cpp +++ b/camera/Encoder_libjpeg.cpp @@ -421,7 +421,7 @@ size_t Encoder_libjpeg::encode(params* input) { jpeg_start_compress(&cinfo, TRUE); - row_tmp = (uint8_t*)malloc(out_width * 3); + row_tmp = (uint8_t*)malloc((out_width - right_crop) * 3); row_src = src + start_offset; row_uv = src + out_width * out_height * bpp; -- cgit v1.1