{"id":11831,"url":"https://patchwork.libcamera.org/api/1.1/patches/11831/?format=json","web_url":"https://patchwork.libcamera.org/patch/11831/","project":{"id":1,"url":"https://patchwork.libcamera.org/api/1.1/projects/1/?format=json","name":"libcamera","link_name":"libcamera","list_id":"libcamera_core","list_email":"libcamera-devel@lists.libcamera.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20210403133741.1595440-2-hiroh@chromium.org>","date":"2021-04-03T13:37:41","name":"[libcamera-devel,v4,2/2] android: CameraDevice: Add more camera3_capture_request validation","commit_ref":null,"pull_url":null,"state":"accepted","archived":false,"hash":"60cf78a44a6f165d3e0622d3085d148c0efd8eb8","submitter":{"id":63,"url":"https://patchwork.libcamera.org/api/1.1/people/63/?format=json","name":"Hirokazu Honda","email":"hiroh@chromium.org"},"delegate":null,"mbox":"https://patchwork.libcamera.org/patch/11831/mbox/","series":[{"id":1887,"url":"https://patchwork.libcamera.org/api/1.1/series/1887/?format=json","web_url":"https://patchwork.libcamera.org/project/libcamera/list/?series=1887","date":"2021-04-03T13:37:40","name":"[libcamera-devel,v4,1/2] android: cameraDevice: Factorize the code of validating camera3_capture_request","version":4,"mbox":"https://patchwork.libcamera.org/series/1887/mbox/"}],"comments":"https://patchwork.libcamera.org/api/patches/11831/comments/","check":"pending","checks":"https://patchwork.libcamera.org/api/patches/11831/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 7518BBD695\n\tfor ;\n\tSat, 3 Apr 2021 13:37:52 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 3996368786;\n\tSat, 3 Apr 2021 15:37:52 +0200 (CEST)","from mail-pg1-x532.google.com (mail-pg1-x532.google.com\n\t[IPv6:2607:f8b0:4864:20::532])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id D413D68786\n\tfor ;\n\tSat, 3 Apr 2021 15:37:50 +0200 (CEST)","by mail-pg1-x532.google.com with SMTP id q10so5248417pgj.2\n\tfor ;\n\tSat, 03 Apr 2021 06:37:50 -0700 (PDT)","from hiroh2.tok.corp.google.com\n\t([2401:fa00:8f:2:d1f5:1b96:f027:f646])\n\tby smtp.gmail.com with ESMTPSA id\n\ts17sm10997414pfc.53.2021.04.03.06.37.47\n\t(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n\tSat, 03 Apr 2021 06:37:48 -0700 (PDT)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n\tunprotected) header.d=chromium.org header.i=@chromium.org\n\theader.b=\"VqAeYNAV\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org;\n\ts=google; \n\th=from:to:cc:subject:date:message-id:in-reply-to:references\n\t:mime-version:content-transfer-encoding;\n\tbh=Dr8dpFFyZeN1I/qolmaSk2O3tNXaJmhJhLsMo02LvB0=;\n\tb=VqAeYNAVns2eyDCktqIiv52iiSRDxR6FzC9eONeu2LmxhOxmf/9XklYTWA8mG4SDKN\n\tb8d3inizKEDpsqVqIGiy2KEJhlp0lrbmMKXw/74BBYV7Mx3vCF1IsIhQZGrh7YQta4Cs\n\tSr6dkJHV11OeMqWgpIHcs5ypUGWGFyZLuEhtk=","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to\n\t:references:mime-version:content-transfer-encoding;\n\tbh=Dr8dpFFyZeN1I/qolmaSk2O3tNXaJmhJhLsMo02LvB0=;\n\tb=Go9q9kmp96Ju6s2YipxxQBQddl3iLJUcytDxsph4lxYlQcy3VuKYRLMJXH558zRxXw\n\tTLIvE3vDoaLKtnVvLAMYORu5fZngCcF3li0UrBVWyg+8TYAOqvcNd8C2safTiF5hoUzA\n\tQQg9LM/oyw7IExlK4lf8gBnkd6/PkdI9itFq8ubri95IrUk+EFJrV/7TikAvdQnFoYxx\n\tZIH9VQiwZxbsT5rfYW/SESd9xzasys7wDx3G0QsUTEeniYTFbVQt9SLZX1AN9ZBs5dR/\n\tPbjdqXW2JIy9rDWxj9J0wsxpmMEgd4vswzaw7BPryx7X8gVIoEdWC+Gp5ob3OoLom/UK\n\tqnWg==","X-Gm-Message-State":"AOAM531X8Is9RyPVSHhrcVJqbvvAOQQAD8UYz39om2dpdZgn2RYy4HUC\n\tFMcVUa6SoDwp1M0ZpTGBJc/YLthChYnrdw==","X-Google-Smtp-Source":"ABdhPJwRMoiAi7MplpdhD3kC4TEshF3cXsI4gM1sKNsQ4dTWKaYtd57JqEEa3FEvSj41D8w/s/ue6A==","X-Received":"by 2002:a05:6a00:174a:b029:1fc:d9ba:da96 with SMTP id\n\tj10-20020a056a00174ab02901fcd9bada96mr16458119pfc.40.1617457069360; \n\tSat, 03 Apr 2021 06:37:49 -0700 (PDT)","From":"Hirokazu Honda ","To":"libcamera-devel@lists.libcamera.org","Date":"Sat, 3 Apr 2021 22:37:41 +0900","Message-Id":"<20210403133741.1595440-2-hiroh@chromium.org>","X-Mailer":"git-send-email 2.31.0.208.g409f899ff0-goog","In-Reply-To":"<20210403133741.1595440-1-hiroh@chromium.org>","References":"<20210403133741.1595440-1-hiroh@chromium.org>","MIME-Version":"1.0","Subject":"[libcamera-devel] [PATCH v4 2/2] android: CameraDevice: Add more\n\tcamera3_capture_request validation","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "},"content":"This adds more validation to camera3_capture_request mainly\nabout buffer_handle values.\n\nSigned-off-by: Hirokazu Honda \nReviewed-by: Laurent Pinchart \n---\n src/android/camera_device.cpp | 29 ++++++++++++++++++++++++++++-\n 1 file changed, 28 insertions(+), 1 deletion(-)","diff":"diff --git a/src/android/camera_device.cpp b/src/android/camera_device.cpp\nindex d8ce43be..91791a10 100644\n--- a/src/android/camera_device.cpp\n+++ b/src/android/camera_device.cpp\n@@ -263,11 +263,38 @@ bool isValidRequest(camera3_capture_request_t *camera3Request)\n \t\treturn false;\n \t}\n \n-\tif (!camera3Request->num_output_buffers) {\n+\tif (!camera3Request->num_output_buffers ||\n+\t !camera3Request->output_buffers) {\n \t\tLOG(HAL, Error) << \"No output buffers provided\";\n \t\treturn false;\n \t}\n \n+\tfor (uint32_t i = 0; i < camera3Request->num_output_buffers; i++) {\n+\t\tconst camera3_stream_buffer_t &outputBuffer =\n+\t\t\tcamera3Request->output_buffers[i];\n+\t\tif (!outputBuffer.buffer || !(*outputBuffer.buffer)) {\n+\t\t\tLOG(HAL, Error) << \"Invalid native handle\";\n+\t\t\treturn false;\n+\t\t}\n+\n+\t\tconst native_handle_t *handle = *outputBuffer.buffer;\n+\t\tconstexpr int kNativeHandleMaxFds = 1024;\n+\t\tif (handle->numFds < 0 || handle->numFds > kNativeHandleMaxFds) {\n+\t\t\tLOG(HAL, Error)\n+\t\t\t\t<< \"Invalid number of fds (\" << handle->numFds\n+\t\t\t\t<< \") in buffer \" << i;\n+\t\t\treturn false;\n+\t\t}\n+\n+\t\tconstexpr int kNativeHandleMaxInts = 1024;\n+\t\tif (handle->numInts < 0 || handle->numInts > kNativeHandleMaxInts) {\n+\t\t\tLOG(HAL, Error)\n+\t\t\t\t<< \"Invalid number of ints (\" << handle->numInts\n+\t\t\t\t<< \") in buffer \" << i;\n+\t\t\treturn false;\n+\t\t}\n+\t}\n+\n \treturn true;\n }\n \n","prefixes":["libcamera-devel","v4","2/2"]}