{"id":11817,"url":"https://patchwork.libcamera.org/api/1.1/patches/11817/?format=json","web_url":"https://patchwork.libcamera.org/patch/11817/","project":{"id":1,"url":"https://patchwork.libcamera.org/api/1.1/projects/1/?format=json","name":"libcamera","link_name":"libcamera","list_id":"libcamera_core","list_email":"libcamera-devel@lists.libcamera.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20210401153123.1217170-2-hiroh@chromium.org>","date":"2021-04-01T15:31:23","name":"[libcamera-devel,2/2] android: CameraDevice: Add more camera3_capture_request validation","commit_ref":null,"pull_url":null,"state":"superseded","archived":false,"hash":"24dc46052e7edd182b0625a9ca05a256051e8225","submitter":{"id":63,"url":"https://patchwork.libcamera.org/api/1.1/people/63/?format=json","name":"Hirokazu Honda","email":"hiroh@chromium.org"},"delegate":null,"mbox":"https://patchwork.libcamera.org/patch/11817/mbox/","series":[{"id":1880,"url":"https://patchwork.libcamera.org/api/1.1/series/1880/?format=json","web_url":"https://patchwork.libcamera.org/project/libcamera/list/?series=1880","date":"2021-04-01T15:31:22","name":"[libcamera-devel,1/2] android: cameraDevice: Factorize the code of validating camera3_capture_request","version":1,"mbox":"https://patchwork.libcamera.org/series/1880/mbox/"}],"comments":"https://patchwork.libcamera.org/api/patches/11817/comments/","check":"pending","checks":"https://patchwork.libcamera.org/api/patches/11817/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 6AA9BC0DA4\n\tfor ;\n\tThu, 1 Apr 2021 15:31:33 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 2477A68785;\n\tThu, 1 Apr 2021 17:31:33 +0200 (CEST)","from mail-pl1-x631.google.com (mail-pl1-x631.google.com\n\t[IPv6:2607:f8b0:4864:20::631])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 7AAB66877D\n\tfor ;\n\tThu, 1 Apr 2021 17:31:31 +0200 (CEST)","by mail-pl1-x631.google.com with SMTP id h8so1196385plt.7\n\tfor ;\n\tThu, 01 Apr 2021 08:31:31 -0700 (PDT)","from hiroh2.tok.corp.google.com\n\t([2401:fa00:8f:2:908:1da:b07c:32bc])\n\tby smtp.gmail.com with ESMTPSA id\n\ty68sm6521573pgy.5.2021.04.01.08.31.28\n\t(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n\tThu, 01 Apr 2021 08:31:29 -0700 (PDT)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n\tunprotected) header.d=chromium.org header.i=@chromium.org\n\theader.b=\"QcGJ/DOY\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org;\n\ts=google; \n\th=from:to:cc:subject:date:message-id:in-reply-to:references\n\t:mime-version:content-transfer-encoding;\n\tbh=hu5U0HoZHiBDDWfLVSbelbfR5T2kB/Jtr+5Fmomcagw=;\n\tb=QcGJ/DOY26/yMyYy+QIgm/HNLxG+atQrwB00SVOQfklbYqIbO8C0Dy5cImDFqeQOrH\n\t08J1O6xcCMU04jSXeZISfQgr57nbxOFi8hMt9FyrEaYooz8wLgmyOGxH7iPSdYHmnVbg\n\thTJ78LsPE/A+tdK7cFtzWA2iAhiv3rtJBWdME=","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to\n\t:references:mime-version:content-transfer-encoding;\n\tbh=hu5U0HoZHiBDDWfLVSbelbfR5T2kB/Jtr+5Fmomcagw=;\n\tb=Vle4bGWkakTtHcyIjtsfN3H+mo0yeKwhkvYsQ6GSGwxCwKZwAETpuJ3ynDY+fnvubz\n\t1hS/bT53+YnHqBgeYV2joBwn4NpB1y6UHfJ5RZ0Vbw4JJD6xNOiVy4Dd5OZR+DESO4Ph\n\tx7sXzHeJp98l7B1Za+iaeDD2gl41GfpI7IOlliO37dGIMT6vayTfQt5YHPJXoOTQsFp3\n\twGhQJtNbWB7m0viTsCW466FaV9ZsWWZ1x4HIM3rvlIBcrlgNJqdTm1LMYlZ006xprYmG\n\tQCc7bLjJ++ZWM16/sAnIie7J+BZ4ZAjd4Ib3giMLn8Ix6tCOExwSaQyFmwE6XSvS9QIL\n\tw0QQ==","X-Gm-Message-State":"AOAM533GXAFVO7OKaYuOo5V6LCZTpMyNiKX2Uijb3PuKXAYDa29uMurl\n\t5HgmZ/hLenilnu22m0VlNtbKYYxheEHwaw==","X-Google-Smtp-Source":"ABdhPJwBJ99+dZEcW50ZN5Ww+1SLCjERAUjc7qbBSgoQPNQCr12hruTEW5jiXSoizzK+Zd2Pw2Orrg==","X-Received":"by 2002:a17:90a:db49:: with SMTP id\n\tu9mr9699646pjx.181.1617291089894; \n\tThu, 01 Apr 2021 08:31:29 -0700 (PDT)","From":"Hirokazu Honda ","To":"libcamera-devel@lists.libcamera.org","Date":"Fri, 2 Apr 2021 00:31:23 +0900","Message-Id":"<20210401153123.1217170-2-hiroh@chromium.org>","X-Mailer":"git-send-email 2.31.0.291.g576ba9dcdaf-goog","In-Reply-To":"<20210401153123.1217170-1-hiroh@chromium.org>","References":"<20210401153123.1217170-1-hiroh@chromium.org>","MIME-Version":"1.0","Subject":"[libcamera-devel] [PATCH 2/2] android: CameraDevice: Add more\n\tcamera3_capture_request validation","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "},"content":"This adds more validation to camera3_capture_request mainly\nabout buffer_handle values.\n\nSigned-off-by: Hirokazu Honda \n---\n src/android/camera_device.cpp | 27 ++++++++++++++++++++++++++-\n 1 file changed, 26 insertions(+), 1 deletion(-)","diff":"diff --git a/src/android/camera_device.cpp b/src/android/camera_device.cpp\nindex 48eb471d..4ed4d3ff 100644\n--- a/src/android/camera_device.cpp\n+++ b/src/android/camera_device.cpp\n@@ -263,11 +263,36 @@ bool isValidRequest(camera3_capture_request_t *camera3Request)\n \t\treturn false;\n \t}\n \n-\tif (!camera3Request->num_output_buffers) {\n+\tif (!camera3Request->num_output_buffers ||\n+\t !camera3Request->output_buffers) {\n \t\tLOG(HAL, Error) << \"No output buffers provided\";\n \t\treturn -EINVAL;\n \t}\n \n+\tfor (uint32_t i = 0; i < camera3Request->num_output_buffers; i++) {\n+\t\tconst camera3_stream_buffer_t &outputBuffer =\n+\t\t\tcamera3Request->output_buffers[i];\n+\t\tif (!outputBuffer.buffer || !(*outputBuffer.buffer)) {\n+\t\t\tLOG(HAL, Error) << \"Invalid native handle\";\n+\t\t\treturn -EINVAL;\n+\t\t}\n+\n+\t\tconst native_handle_t *handle = *outputBuffer.buffer;\n+\t\tconstexpr int kNativeHandleMaxFds = 1024;\n+\t\tif (handle->numFds < 0 || handle->numFds > kNativeHandleMaxFds) {\n+\t\t\tLOG(HAL, Error) << \"Invalid number of fds: \"\n+\t\t\t\t\t<< handle->numFds;\n+\t\t\treturn -EINVAL;\n+\t\t}\n+\n+\t\tconstexpr int kNativeHandleMaxInts = 1024;\n+\t\tif (handle->numInts < 0 || handle->numInts > kNativeHandleMaxInts) {\n+\t\t\tLOG(HAL, Error) << \"Invalid number of data\"\n+\t\t\t\t\t<< handle->numInts;\n+\t\t\treturn -EINVAL;\n+\t\t}\n+\t}\n+\n \treturn true;\n }\n \n","prefixes":["libcamera-devel","2/2"]}