Patch Detail
Show a patch.
GET /api/1.1/patches/4192/?format=api
{ "id": 4192, "url": "https://patchwork.libcamera.org/api/1.1/patches/4192/?format=api", "web_url": "https://patchwork.libcamera.org/patch/4192/", "project": { "id": 1, "url": "https://patchwork.libcamera.org/api/1.1/projects/1/?format=api", "name": "libcamera", "link_name": "libcamera", "list_id": "libcamera_core", "list_email": "libcamera-devel@lists.libcamera.org", "web_url": "", "scm_url": "", "webscm_url": "" }, "msgid": "<20200623190836.53446-19-paul.elder@ideasonboard.com>", "date": "2020-06-23T19:08:32", "name": "[libcamera-devel,v3,18/22] v4l2: v4l2_camera_proxy: Check arg->index bounds for querybuf, qbuf, dqbuf", "commit_ref": null, "pull_url": null, "state": "superseded", "archived": false, "hash": "92d9336d0d8fd0a953c0b09d4e7f8cf2e42df281", "submitter": { "id": 17, "url": "https://patchwork.libcamera.org/api/1.1/people/17/?format=api", "name": "Paul Elder", "email": "paul.elder@ideasonboard.com" }, "delegate": null, "mbox": "https://patchwork.libcamera.org/patch/4192/mbox/", "series": [ { "id": 1034, "url": "https://patchwork.libcamera.org/api/1.1/series/1034/?format=api", "web_url": "https://patchwork.libcamera.org/project/libcamera/list/?series=1034", "date": "2020-06-23T19:08:14", "name": "Support v4l2-compliance", "version": 3, "mbox": "https://patchwork.libcamera.org/series/1034/mbox/" } ], "comments": "https://patchwork.libcamera.org/api/patches/4192/comments/", "check": "pending", "checks": "https://patchwork.libcamera.org/api/patches/4192/checks/", "tags": {}, "headers": { "Return-Path": "<paul.elder@ideasonboard.com>", "Received": [ "from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[IPv6:2001:4b98:dc2:55:216:3eff:fef7:d647])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id C4E23609A5\n\tfor <libcamera-devel@lists.libcamera.org>;\n\tTue, 23 Jun 2020 21:09:45 +0200 (CEST)", "from jade.rasen.tech (unknown\n\t[IPv6:2400:4051:61:600:8147:f2a2:a8c6:9087])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id B5C562A9;\n\tTue, 23 Jun 2020 21:09:43 +0200 (CEST)" ], "Authentication-Results": "lancelot.ideasonboard.com; dkim=pass (1024-bit key; \n\tunprotected) header.d=ideasonboard.com\n\theader.i=@ideasonboard.com\n\theader.b=\"KcjDk03h\"; dkim-atps=neutral", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1592939385;\n\tbh=+ldAsMt5KhKmo97FB8zt46H9a0qCr0lrgG3IYiL9Zjw=;\n\th=From:To:Cc:Subject:Date:In-Reply-To:References:From;\n\tb=KcjDk03h5GdrFzmueTdswJmd0S0v4uHkhfew2NggCT7ArOJ+3iaahEdosCTh1+OUK\n\t9ICJth3jjHQj/gedg8XmJhkyPOufbDqoakpXS452pB00mK43u00iAJt9T9HlI6HIJP\n\tFfbLKNa7AuOPjkhW+m7Xco5o+zbQz8uzTxMIcq/U=", "From": "Paul Elder <paul.elder@ideasonboard.com>", "To": "libcamera-devel@lists.libcamera.org", "Date": "Wed, 24 Jun 2020 04:08:32 +0900", "Message-Id": "<20200623190836.53446-19-paul.elder@ideasonboard.com>", "X-Mailer": "git-send-email 2.27.0", "In-Reply-To": "<20200623190836.53446-1-paul.elder@ideasonboard.com>", "References": "<20200623190836.53446-1-paul.elder@ideasonboard.com>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "Subject": "[libcamera-devel] [PATCH v3 18/22] v4l2: v4l2_camera_proxy: Check\n\targ->index bounds for querybuf, qbuf, dqbuf", "X-BeenThere": "libcamera-devel@lists.libcamera.org", "X-Mailman-Version": "2.1.29", "Precedence": "list", "List-Id": "<libcamera-devel.lists.libcamera.org>", "List-Unsubscribe": "<https://lists.libcamera.org/options/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=unsubscribe>", "List-Archive": "<https://lists.libcamera.org/pipermail/libcamera-devel/>", "List-Post": "<mailto:libcamera-devel@lists.libcamera.org>", "List-Help": "<mailto:libcamera-devel-request@lists.libcamera.org?subject=help>", "List-Subscribe": "<https://lists.libcamera.org/listinfo/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=subscribe>", "X-List-Received-Date": "Tue, 23 Jun 2020 19:09:46 -0000" }, "content": "There were no bounds checks for the index argument for VIDIOC_QUERYBUF,\nVIDIOC_QBUF, and VIDIOC_DQBUF. Add them.\n\nSigned-off-by: Paul Elder <paul.elder@ideasonboard.com>\nReviewed-by: Jacopo Mondi <jacopo@jmondi.org>\nReviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>\n\n---\nChanges in v3:\n- don't check for ownership on querybuf\n\nNo change in v2\n---\n src/v4l2/v4l2_camera_proxy.cpp | 9 +++++++++\n 1 file changed, 9 insertions(+)", "diff": "diff --git a/src/v4l2/v4l2_camera_proxy.cpp b/src/v4l2/v4l2_camera_proxy.cpp\nindex 8420e23..0e87631 100644\n--- a/src/v4l2/v4l2_camera_proxy.cpp\n+++ b/src/v4l2/v4l2_camera_proxy.cpp\n@@ -545,6 +545,9 @@ int V4L2CameraProxy::vidioc_querybuf(V4L2CameraFile *file, struct v4l2_buffer *a\n {\n \tLOG(V4L2Compat, Debug) << \"Servicing vidioc_querybuf fd = \" << file->efd();\n \n+\tif (arg->index >= bufferCount_)\n+\t\treturn -EINVAL;\n+\n \tif (!validateBufferType(arg->type) ||\n \t arg->index >= bufferCount_)\n \t\treturn -EINVAL;\n@@ -561,6 +564,9 @@ int V4L2CameraProxy::vidioc_qbuf(V4L2CameraFile *file, struct v4l2_buffer *arg)\n \tLOG(V4L2Compat, Debug) << \"Servicing vidioc_qbuf, index = \"\n \t\t\t << arg->index << \" fd = \" << file->efd();\n \n+\tif (arg->index >= bufferCount_)\n+\t\treturn -EINVAL;\n+\n \tif (!hasOwnership(file))\n \t\treturn -EBUSY;\n \n@@ -583,6 +589,9 @@ int V4L2CameraProxy::vidioc_dqbuf(V4L2CameraFile *file, struct v4l2_buffer *arg)\n {\n \tLOG(V4L2Compat, Debug) << \"Servicing vidioc_dqbuf fd = \" << file->efd();\n \n+\tif (arg->index >= bufferCount_)\n+\t\treturn -EINVAL;\n+\n \tif (!hasOwnership(file))\n \t\treturn -EBUSY;\n \n", "prefixes": [ "libcamera-devel", "v3", "18/22" ] }