From ae981e6f0e664e9a23e8cf9b838dad0eafea00a4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mirk=C3=B3=20Visontai?= Date: Mon, 13 Jul 2026 11:15:28 -0700 Subject: [PATCH] avdevice/android_camera: fix OOB read in metadata parsing ACAMERA_SCALER_AVAILABLE_STREAM_CONFIGURATIONS metadata is an int32[n*4] array (one 4-tuple per stream config: format, width, height, input/output flag). ACameraMetadata_const_entry.count is the total number of int32_t elements, not the number of tuples. The loop bound must be count/4 to avoid iterating past the end of the array. Similarly, ACAMERA_CONTROL_AE_AVAILABLE_TARGET_FPS_RANGES is an int32[n*2] array (min/max pairs). The loop bound must be count/2. Without this fix, both loops over-iterate and read heap memory beyond the metadata array bounds. Signed-off-by: Mirko Visontai (cherry picked from commit 1588bce21b6d5d9064fd9576c038fd8d6ec8beac) Signed-off-by: Michael Niedermayer --- libavdevice/android_camera.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavdevice/android_camera.c b/libavdevice/android_camera.c index 8433286296..7abdb6bd7b 100644 --- a/libavdevice/android_camera.c +++ b/libavdevice/android_camera.c @@ -249,7 +249,7 @@ static void match_video_size(AVFormatContext *avctx) ACAMERA_SCALER_AVAILABLE_STREAM_CONFIGURATIONS, &available_configs); - for (int i = 0; i < available_configs.count; i++) { + for (int i = 0; i < available_configs.count / 4; i++) { int32_t input = available_configs.data.i32[i * 4 + 3]; int32_t format = available_configs.data.i32[i * 4 + 0]; @@ -296,7 +296,7 @@ static void match_framerate(AVFormatContext *avctx) ACAMERA_CONTROL_AE_AVAILABLE_TARGET_FPS_RANGES, &available_framerates); - for (int i = 0; i < available_framerates.count; i++) { + for (int i = 0; i < available_framerates.count / 2; i++) { int32_t min = available_framerates.data.i32[i * 2 + 0]; int32_t max = available_framerates.data.i32[i * 2 + 1];