{"id":12307,"url":"https://patchwork.libcamera.org/api/1.1/patches/12307/?format=json","web_url":"https://patchwork.libcamera.org/patch/12307/","project":{"id":1,"url":"https://patchwork.libcamera.org/api/1.1/projects/1/?format=json","name":"libcamera","link_name":"libcamera","list_id":"libcamera_core","list_email":"libcamera-devel@lists.libcamera.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20210515183826.21003-5-laurent.pinchart@ideasonboard.com>","date":"2021-05-15T18:38:26","name":"[libcamera-devel,4/4] android: camera_metadata: Add type sanity check to updateEntry()","commit_ref":null,"pull_url":null,"state":"accepted","archived":false,"hash":"a8aaf6db2494b5152750cef57c06139a58dd841e","submitter":{"id":2,"url":"https://patchwork.libcamera.org/api/1.1/people/2/?format=json","name":"Laurent Pinchart","email":"laurent.pinchart@ideasonboard.com"},"delegate":{"id":14,"url":"https://patchwork.libcamera.org/api/1.1/users/14/?format=json","username":"pinchartl","first_name":"Laurent","last_name":"Pinchart","email":"laurent.pinchart@ideasonboard.com"},"mbox":"https://patchwork.libcamera.org/patch/12307/mbox/","series":[{"id":2033,"url":"https://patchwork.libcamera.org/api/1.1/series/2033/?format=json","web_url":"https://patchwork.libcamera.org/project/libcamera/list/?series=2033","date":"2021-05-15T18:38:22","name":"android: camera_metadata: Miscellaneous improvements","version":1,"mbox":"https://patchwork.libcamera.org/series/2033/mbox/"}],"comments":"https://patchwork.libcamera.org/api/patches/12307/comments/","check":"pending","checks":"https://patchwork.libcamera.org/api/patches/12307/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 9F4BEC31FB\n\tfor ;\n\tSat, 15 May 2021 18:38:45 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 358066891C;\n\tSat, 15 May 2021 20:38:45 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[IPv6:2001:4b98:dc2:55:216:3eff:fef7:d647])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 8E69C68922\n\tfor ;\n\tSat, 15 May 2021 20:38:41 +0200 (CEST)","from pendragon.lan (62-78-145-57.bb.dnainternet.fi [62.78.145.57])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id D9ADC436;\n\tSat, 15 May 2021 20:38:40 +0200 (CEST)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n\tunprotected) header.d=ideasonboard.com header.i=@ideasonboard.com\n\theader.b=\"jNT0V874\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1621103921;\n\tbh=hFx1vZWboqmba7kNCvzD3RUJNZ78+tS9s2S2+nB4hWs=;\n\th=From:To:Cc:Subject:Date:In-Reply-To:References:From;\n\tb=jNT0V874KtyL5ySThaeCe1lguZ+HhZChGc1BnNvkSfoouf7hyrom3a/Yh9QmN4H7L\n\t0tIxgSdTEqS+W5VoIPCqXPspySxAuyriB4azuruNVr8j0a0gHfTaWO90ljVn3euYpU\n\tLotpLSnisaarUy1e98X3c8Q1nZen0XMFVNTByjLI=","From":"Laurent Pinchart ","To":"libcamera-devel@lists.libcamera.org","Date":"Sat, 15 May 2021 21:38:26 +0300","Message-Id":"<20210515183826.21003-5-laurent.pinchart@ideasonboard.com>","X-Mailer":"git-send-email 2.28.1","In-Reply-To":"<20210515183826.21003-1-laurent.pinchart@ideasonboard.com>","References":"<20210515183826.21003-1-laurent.pinchart@ideasonboard.com>","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","Subject":"[libcamera-devel] [PATCH 4/4] android: camera_metadata: Add type\n\tsanity check to updateEntry()","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "},"content":"The CameraMetadata::updateEntry() functions cast the data pointer to a\nvoid pointer, which is then used internally to call\nupdate_camera_metadata_entry(). If the caller passes a pointer to an\nincorrect data type, the behaviour is undefined, with possible crashes\nif the incorrect data type is smaller than expected by the Android\nmetadata library.\n\nTo avoid crashes, make all public updateEntry() functions take typed\npointers, and pass the element size to the internal function. The\nelement size is then checked against the expected size, and an error\nmessage logged if they don't match. This won't catch incorrect data\ntypes that have the same size as the correct type, but will at least\navoid potential crashes.\n\nSigned-off-by: Laurent Pinchart \n---\n src/android/camera_metadata.cpp | 11 ++++++++++-\n src/android/camera_metadata.h | 12 +++++++++---\n 2 files changed, 19 insertions(+), 4 deletions(-)","diff":"diff --git a/src/android/camera_metadata.cpp b/src/android/camera_metadata.cpp\nindex 59366c50cc16..3eb71d7f7d9d 100644\n--- a/src/android/camera_metadata.cpp\n+++ b/src/android/camera_metadata.cpp\n@@ -137,7 +137,8 @@ bool CameraMetadata::addEntry(uint32_t tag, const void *data, size_t count,\n \treturn false;\n }\n \n-bool CameraMetadata::updateEntry(uint32_t tag, const void *data, size_t count)\n+bool CameraMetadata::updateEntry(uint32_t tag, const void *data, size_t count,\n+\t\t\t\t size_t elementSize)\n {\n \tif (!valid_)\n \t\treturn false;\n@@ -152,6 +153,14 @@ bool CameraMetadata::updateEntry(uint32_t tag, const void *data, size_t count)\n \t\treturn false;\n \t}\n \n+\tif (camera_metadata_type_size[entry.type] != elementSize) {\n+\t\tconst char *name = get_camera_metadata_tag_name(tag);\n+\t\tLOG(CameraMetadata, Error)\n+\t\t\t<< \"Invalid element size for tag \"\n+\t\t\t<< (name ? name : \"\") << \": not present\";\n+\t\treturn false;\n+\t}\n+\n \tsize_t oldSize =\n \t\tcalculate_camera_metadata_entry_data_size(entry.type,\n \t\t\t\t\t\t\t entry.count);\ndiff --git a/src/android/camera_metadata.h b/src/android/camera_metadata.h\nindex d7c8d9df689f..f8f2a0d23aa3 100644\n--- a/src/android/camera_metadata.h\n+++ b/src/android/camera_metadata.h\n@@ -55,7 +55,7 @@ public:\n \ttemplate\n \tbool updateEntry(uint32_t tag, const T &data)\n \t{\n-\t\treturn updateEntry(tag, &data, 1);\n+\t\treturn updateEntry(tag, &data, 1, sizeof(T));\n \t}\n \n \ttemplate\n@@ -68,10 +68,14 @@ public:\n \t\t typename T = typename S::value_type>\n \tbool updateEntry(uint32_t tag, const S &data)\n \t{\n-\t\treturn updateEntry(tag, data.data(), data.size());\n+\t\treturn updateEntry(tag, data.data(), data.size(), sizeof(T));\n \t}\n \n-\tbool updateEntry(uint32_t tag, const void *data, size_t count);\n+\ttemplate\n+\tbool updateEntry(uint32_t tag, const T *data, size_t count)\n+\t{\n+\t\treturn updateEntry(tag, data, count, sizeof(T));\n+\t}\n \n \tcamera_metadata_t *get();\n \tconst camera_metadata_t *get() const;\n@@ -80,6 +84,8 @@ private:\n \tbool resize(size_t count, size_t size);\n \tbool addEntry(uint32_t tag, const void *data, size_t count,\n \t\t size_t elementSize);\n+\tbool updateEntry(uint32_t tag, const void *data, size_t count,\n+\t\t\t size_t elementSize);\n \n \tcamera_metadata_t *metadata_;\n \tbool valid_;\n","prefixes":["libcamera-devel","4/4"]}