Snap for 7080740 from 9ec8c86860a4e5739f9f31ba38f5976abadd0546 to mainline-tethering-releaseandroid-mainline-11.0.0_r43android-mainline-11.0.0_r24android11-mainline-tethering-release

Change-Id: I0ecbfaf99e24ce1c1fe15c6de1345771ca69dd39

1 files changed, 13 insertions, 3 deletions

diff --git a/libexif/pentax/mnote-pentax-entry.c b/libexif/pentax/mnote-pentax-entry.c
index 7e97c2c..dcb1560 100644
--- a/libexif/pentax/mnote-pentax-entry.c
+++ b/libexif/pentax/mnote-pentax-entry.c
@@ -425,24 +425,34 @@ mnote_pentax_entry_get_value (MnotePentaxEntry *entry,
 		case EXIF_FORMAT_SHORT:
 		  {
 			const unsigned char *data = entry->data;
-		  	size_t k, len = strlen(val);
+		  	size_t k, len = strlen(val), sizeleft;
+
+			sizeleft = entry->size;
 		  	for(k=0; k<entry->components; k++) {
+				if (sizeleft < 2)
+					break;
 				vs = exif_get_short (data, entry->order);
 				snprintf (val+len, maxlen-len, "%i ", vs);
 				len = strlen(val);
 				data += 2;
+				sizeleft -= 2;
 			}
 		  }
 		  break;
 		case EXIF_FORMAT_LONG:
 		  {
 			const unsigned char *data = entry->data;
-		  	size_t k, len = strlen(val);
+		  	size_t k, len = strlen(val), sizeleft;
+
+			sizeleft = entry->size;
 		  	for(k=0; k<entry->components; k++) {
+				if (sizeleft < 4)
+					break;
 				vl = exif_get_long (data, entry->order);
 				snprintf (val+len, maxlen-len, "%li", (long int) vl);
 				len = strlen(val);
 				data += 4;
+				sizeleft -= 4;
 			}
 		  }
 		  break;
@@ -455,5 +465,5 @@ mnote_pentax_entry_get_value (MnotePentaxEntry *entry,
 		break;
 	}
 
-	return (val);
+	return val;
 }