Before calling handle_video_timestamp() and handle_stars_info(),
only e->tag was checked without verifying e->format matches the expected type.
This could cause OOB read when malicious EXIF data has mismatched format.
- handle_video_timestamp expects EXIF_FORMAT_RATIONAL (8 bytes per component)
- handle_stars_info expects EXIF_FORMAT_SLONG (4 bytes per component)
If format is set to a smaller type (e.g., BYTE = 1 byte) while components
remain large, exif_get_rational/exif_get_slong would read beyond allocated
e->data buffer.
Change-Id: I287a8c22c7dc1a6905f75e97d9f45e7f9f42a1cb
Signed-off-by: lifuminharmony <lifumin3@h-partners.com>
Co-Authored-By: Agent
Signed-off-by: lifuminharmony <lifumin3@h-partners.com>
lifuminharmony
ef8dbb5eb0