mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2026-08-09 17:39:08 +00:00
1588bce21b
ACAMERA_SCALER_AVAILABLE_STREAM_CONFIGURATIONS metadata is an int32[n*4] array (one 4-tuple per stream config: format, width, height, input/output flag). ACameraMetadata_const_entry.count is the total number of int32_t elements, not the number of tuples. The loop bound must be count/4 to avoid iterating past the end of the array. Similarly, ACAMERA_CONTROL_AE_AVAILABLE_TARGET_FPS_RANGES is an int32[n*2] array (min/max pairs). The loop bound must be count/2. Without this fix, both loops over-iterate and read heap memory beyond the metadata array bounds. Signed-off-by: Mirko Visontai <mirkov@google.com>