commit 2c9873c1387355f0543c93d56b4849b0f84730f7
author Tharaga Balachandran <tbalacha@codeaurora.org> Tue Mar 10 12:49:18 2020 -0400
committer Baldev Sahu <bsahu@codeaurora.org> Tue May 12 09:33:33 2020 +0530
tree c7b1c95194e02259e25467b856118afa388ef4ce
parent b3d66dcc34b36e3edcff317db6671321a60125d4

gralloc: Check HDR dynamic metadata size before returning.

CRs-Fixed: 2638571
Change-Id: Ie61b4362ba253d2bec7b8e72272aee76ed9c8269

gralloc/gr_buf_mgr.cpp

diff --git a/gralloc/gr_buf_mgr.cpp b/gralloc/gr_buf_mgr.cpp
index e9fcb81..b6dc2a0 100644
--- a/gralloc/gr_buf_mgr.cpp
+++ b/gralloc/gr_buf_mgr.cpp
@@ -928,9 +928,10 @@
     }
     case (int64_t)StandardMetadataType::SMPTE2094_40: {
       std::vector<uint8_t> dynamic_metadata_payload;
-      if (metadata->color.dynamicMetaDataValid) {
+      if (metadata->color.dynamicMetaDataValid &&
+          metadata->color.dynamicMetaDataLen <= HDR_DYNAMIC_META_DATA_SZ) {
         dynamic_metadata_payload.resize(metadata->color.dynamicMetaDataLen);
-        memcpy(&dynamic_metadata_payload, &metadata->color.dynamicMetaDataPayload,
+        memcpy(dynamic_metadata_payload.data(), &metadata->color.dynamicMetaDataPayload,
                metadata->color.dynamicMetaDataLen);
         android::gralloc4::encodeSmpte2094_40(dynamic_metadata_payload, out);
       } else {