ACAMERA_SCALER_AVAILABLE_STREAM_CONFIGURATIONS metadata is an
int32[n*4] array (one 4-tuple per stream config: format, width,
height, input/output flag). ACameraMetadata_const_entry.count is the
total number of int32_t elements, not the number of tuples. The loop
bound must be count/4 to avoid iterating past the end of the array.
Similarly, ACAMERA_CONTROL_AE_AVAILABLE_TARGET_FPS_RANGES is an
int32[n*2] array (min/max pairs). The loop bound must be count/2.
Without this fix, both loops over-iterate and read heap memory
beyond the metadata array bounds.
Signed-off-by: Mirko Visontai <mirkov@google.com>
(cherry picked from commit 1588bce21b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
ae981e6f0e