JPEG Corruption when writing Location Data to Exif on Samsung A Series devices running Android 12 [263289024]

Fixed

Bug

Status Update

No update yet.

Description

mw...@gmail.com

created issue #1

Dec 20, 2022 11:37PM

CAMERAX VERSION: 1.1.1, 1.2.0

CAMERA APPLICATION NAME AND VERSION: (Settings > Apps > (app name) > version) CameraXBasic demo 1.0.0

ANDROID OS BUILD NUMBER: (Settings > About > Build number):

SP1A.210812.016.A136U1UES2BVI1

Note that this has happened on all Android 12 variants we've tested

DEVICE NAME: Samsung A13, Samsung A32, Samsung A12 (Only with Android 12)

DESCRIPTION:

LIST ANY EXPERIMENTAL FEATURES: (As an example - @ExperimentalCamera2Interop) None

STEPS TO REPRODUCE: Using CameraXBasic Demo app:

Modify CameraXBasic demo app and add a Location to the Metadata object used for OutputFileOptions (within CameraFragment)
Open the app and accept permissions
Capture a photo

OBSERVED RESULTS: A corrupt JPEG file is created with an invalid EXIF header. The length of the EXIF section appears to be invalid, which prevents the photo from being viewable.

In the app, the photo preview has an all black screen. The thumbnail does not show up either. In the we see Glide failing to create a thumbnail and the app is unable to get the dimensions of the photo. Inspecting these files with a hex editor, indicates an invalid EXIF header that has the wrong length field. Manually overwriting the length to match the size before the IDR block (indicated by FFD8) will allow these photos to be viewable.

EXPECTED RESULTS: Photo should be viewable. Thumbnail should be created.

REPRODUCIBILITY: (5 of 5, 1 of 100, etc)

ADDITIONAL INFORMATION: We released this code in our app and have seen thousands of corrupted photos come through on several variants of Samsung A series devices running Android 12. This problem did not reproduce with the devices with the stock version of Android they came with. These devices are supposedly tested by google test lab but it seems they must not be testing them with Android 12.

CODE FRAGMENTS (this will help us troubleshoot your issues): See: https://github.com/mwolfeaxon/cameraxdemo This demo is the same as https://github.com/android/camera-samples/tree/master/CameraXBasic but with a Location object added to Metadata of OutputFileOptions.

Relevant code to reproduce:

  val metadata = Metadata().apply {
    isReversedHorizontal = lensFacing == CameraSelector.LENS_FACING_FRONT
    location = Location("fused").apply {
            latitude = 37.419857
            longitude = -122.0778827
            altitude = 0.0
            time = System.currentTimeMillis() - 1000
            accuracy = 13.747f
        }
    
  }
  val outputOptions = ImageCapture.OutputFileOptions.Builder(photoFile)
                        .setMetadata(metadata)
                        .build()
   imageCapture.takePicture(
                        outputOptions, cameraExecutor, object : ImageCapture.OnImageSavedCallback { ... }

Comments

wu...@google.com <wu...@google.com> #2Dec 21, 2022 05:34AM

A couple of questions:

1. Have you saw crash in real device or only in simulators?
2. Do you use dynamic feature for language ID?

mw...@gmail.com <mw...@gmail.com> #3Dec 21, 2022 07:14AM

Tested on Android 12 Emulator with custom executor, but cannot repro this issue.

wu...@google.com <wu...@google.com> Dec 21, 2022 08:20AM

Reassigned to ch...@google.com.

ch...@google.com <ch...@google.com> Dec 21, 2022 11:35AM

Accepted by ch...@google.com.

ch...@google.com <ch...@google.com> #4Dec 26, 2022 02:31AM

Second crash in the description is from a real device. Experienced it myself on two different Xiaomi phones, plus lots of crashes from users in the Google Play console.
Dynamic features are not used in the application.

As a wild guess, I have downgraded build tools from 31.0.0 to 30.0.3, compileSdk from 31 to 30, and moved all work with Language ID to the service in a separate process (just to be sure that crash can kill secondary process instead of main). This combination is in beta for 2 days by now and I don't see any SIGSEGV crashes.

ch...@google.com <ch...@google.com> #5Dec 27, 2022 02:08AM

Hmm, I feel the crash might be something related to separate/secondary process.

I also changed compileSdk and targetSDK to 31 but still cannot repro this issue.

ap...@google.com <ap...@google.com> #6Jan 3, 2023 03:18AM

On the contrary, there was no separate process before, when crashes started.

In the new build (with the aforementioned changes) I can see SIGSEGV crash, but only one instead of dozens and it has a bit different backtrace:

signal 11 (SIGSEGV), code 1 (SEGV_MAPERR)
liblanguage_id_jni.so (offset 0x11e000)

backtrace:
  #00  pc 000000000003c7c0  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/split_config.arm64_v8a.apk!lib/arm64-v8a/liblanguage_id_jni.so (offset 0x11e000)
  #00  pc 000000000003b960  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/split_config.arm64_v8a.apk!lib/arm64-v8a/liblanguage_id_jni.so (offset 0x11e000)
  #00  pc 000000000003bb48  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/split_config.arm64_v8a.apk!lib/arm64-v8a/liblanguage_id_jni.so (offset 0x11e000)
  #00  pc 000000000003bafc  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/split_config.arm64_v8a.apk!lib/arm64-v8a/liblanguage_id_jni.so (offset 0x11e000)
  #00  pc 0000000000036c98  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/split_config.arm64_v8a.apk!lib/arm64-v8a/liblanguage_id_jni.so (offset 0x11e000)
  #00  pc 0000000000032714  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/split_config.arm64_v8a.apk!lib/arm64-v8a/liblanguage_id_jni.so (offset 0x11e000)
  #00  pc 0000000000031cac  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/split_config.arm64_v8a.apk!lib/arm64-v8a/liblanguage_id_jni.so (offset 0x11e000)
  #00  pc 0000000000057438  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/oat/arm64/base.odex (offset 0x57000)

ey...@gmail.com <ey...@gmail.com> #7Jan 10, 2023 03:46PM

FYI, ML Kit launched a new language ID SDK in the latest release, which uses a new language ID model. https://developers.google.com/ml-kit/release-notes#august_11_2021

Could you try the new SDK version(17.0.0) to check if you can still repro this native crash? Thanks!

ch...@google.com <ch...@google.com> #8Jan 11, 2023 03:15AM

Marked as fixed.

Thank you, I'll try it and check.

pr...@google.com <pr...@google.com> #9Jan 25, 2023 09:35PM

Hello. I have similar experience.

I'm using mlkit-language 16.1.1
I didnot meet this error until using AGP 4.2
I can get this error since using AGP 7.0
This error raised on Release build only(minimized by R8)
This error raised without obfuscation.