diff options
| -rw-r--r-- | media/jni/android_media_Utils.cpp | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/media/jni/android_media_Utils.cpp b/media/jni/android_media_Utils.cpp index b7ad6dcf9354..fbebbdcb8761 100644 --- a/media/jni/android_media_Utils.cpp +++ b/media/jni/android_media_Utils.cpp @@ -123,10 +123,15 @@ uint32_t Image_getBlobSize(LockedImage* buffer, bool usingRGBAOverride) { // First check for BLOB transport header at the end of the buffer uint8_t* header = blobBuffer + (width - sizeof(struct camera3_jpeg_blob_v2)); - struct camera3_jpeg_blob_v2 *blob = (struct camera3_jpeg_blob_v2*)(header); - if (blob->jpeg_blob_id == CAMERA3_JPEG_BLOB_ID || - blob->jpeg_blob_id == CAMERA3_HEIC_BLOB_ID) { - size = blob->jpeg_size; + + // read camera3_jpeg_blob_v2 from the end of the passed buffer. + // requires memcpy because 'header' might not be properly aligned. + struct camera3_jpeg_blob_v2 blob; + memcpy(&blob, header, sizeof(struct camera3_jpeg_blob_v2)); + + if (blob.jpeg_blob_id == CAMERA3_JPEG_BLOB_ID || + blob.jpeg_blob_id == CAMERA3_HEIC_BLOB_ID) { + size = blob.jpeg_size; ALOGV("%s: Jpeg/Heic size = %d", __FUNCTION__, size); } |