Modify buffer overflow when image was rotated

[Problem] Crash happen by buffer overflow

[Cause]
The size of the buffer is calculated with width, height and format
The width should be a multiple of 4 or 8, so the size of the buffer is affected from the width.
But the width and the height were swapped for some cases. So the size of the buffer was not correct.

[Solution]
To swap the width and the height is not neccessary. It is removed.

Change-Id: I832b18a50470681588137ace90d0f6178c96a927
Signed-off-by: Jiyong Min <jiyong.min@samsung.com>

diff --git a/imgp/mm_util_imgp.c b/imgp/mm_util_imgp.c
index 6549c40..d285879 100755 (executable)
--- a/imgp/mm_util_imgp.c
+++ b/imgp/mm_util_imgp.c
@@ -1111,20 +1111,15 @@ static int __mm_util_processing(mm_util_s *handle)
 
        if (handle->set_rotate) {
                dst_index++;
-               if (handle->set_resize || handle->set_crop) {
-                       unsigned int temp_swap = 0;
-                       switch (handle->dst_rotation) {
-                       case  MM_UTIL_ROTATION_90:
-                       case MM_UTIL_ROTATION_270:
-                               temp_swap = src_width;
-                               src_width  = src_height;
-                               src_height = temp_swap;
-                               break;
-                       default:
-                               break;
-                       }
+               switch (handle->dst_rotation) {
+               case  MM_UTIL_ROTATION_90:
+               case MM_UTIL_ROTATION_270:
+                       mm_util_get_image_size(src_format, src_height, src_width, &dst_buf_size);
+                       break;
+               default:
+                       mm_util_get_image_size(src_format, src_width, src_height, &dst_buf_size);
+                       break;
                }
-               mm_util_get_image_size(src_format, src_width, src_height, &dst_buf_size);
                dst_buf[dst_index] = calloc(1, dst_buf_size);
                if (dst_buf[dst_index] == NULL) {
                        mm_util_error("[multi func] memory allocation error");

diff --git a/packaging/libmm-utility.spec b/packaging/libmm-utility.spec
index 7d5e7dc..9e878f1 100755 (executable)
--- a/packaging/libmm-utility.spec
+++ b/packaging/libmm-utility.spec
@@ -1,6 +1,6 @@
 Name:       libmm-utility
 Summary:    Multimedia Framework Utility Library
-Version:    0.46
+Version:    0.47
 Release:    0
 Group:      System/Libraries
 License:    Apache-2.0