{"id":11819,"url":"https://patchwork.libcamera.org/api/patches/11819/?format=json","web_url":"https://patchwork.libcamera.org/patch/11819/","project":{"id":1,"url":"https://patchwork.libcamera.org/api/projects/1/?format=json","name":"libcamera","link_name":"libcamera","list_id":"libcamera_core","list_email":"libcamera-devel@lists.libcamera.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20210402015529.1284943-2-hiroh@chromium.org>","date":"2021-04-02T01:55:29","name":"[libcamera-devel,v2,2/2] android: CameraDevice: Add more camera3_capture_request validation","commit_ref":null,"pull_url":null,"state":"superseded","archived":false,"hash":"a59b813ddbf086c1f8e110ae8f2a414bed06029d","submitter":{"id":63,"url":"https://patchwork.libcamera.org/api/people/63/?format=json","name":"Hirokazu Honda","email":"hiroh@chromium.org"},"delegate":null,"mbox":"https://patchwork.libcamera.org/patch/11819/mbox/","series":[{"id":1881,"url":"https://patchwork.libcamera.org/api/series/1881/?format=json","web_url":"https://patchwork.libcamera.org/project/libcamera/list/?series=1881","date":"2021-04-02T01:55:28","name":"[libcamera-devel,v2,1/2] android: cameraDevice: Factorize the code of validating camera3_capture_request","version":2,"mbox":"https://patchwork.libcamera.org/series/1881/mbox/"}],"comments":"https://patchwork.libcamera.org/api/patches/11819/comments/","check":"pending","checks":"https://patchwork.libcamera.org/api/patches/11819/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id EE5C3C0DA3\n\tfor ;\n\tFri, 2 Apr 2021 01:55:41 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id AA52968787;\n\tFri, 2 Apr 2021 03:55:41 +0200 (CEST)","from mail-pj1-x102a.google.com (mail-pj1-x102a.google.com\n\t[IPv6:2607:f8b0:4864:20::102a])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 11DD368783\n\tfor ;\n\tFri, 2 Apr 2021 03:55:40 +0200 (CEST)","by mail-pj1-x102a.google.com with SMTP id\n\tkk2-20020a17090b4a02b02900c777aa746fso1922214pjb.3\n\tfor ;\n\tThu, 01 Apr 2021 18:55:40 -0700 (PDT)","from hiroh2.tok.corp.google.com\n\t([2401:fa00:8f:2:908:1da:b07c:32bc])\n\tby smtp.gmail.com with ESMTPSA id\n\ta65sm6540329pfb.116.2021.04.01.18.55.37\n\t(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n\tThu, 01 Apr 2021 18:55:38 -0700 (PDT)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n\tunprotected) header.d=chromium.org header.i=@chromium.org\n\theader.b=\"ec40m/Wo\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org;\n\ts=google; \n\th=from:to:cc:subject:date:message-id:in-reply-to:references\n\t:mime-version:content-transfer-encoding;\n\tbh=S5f6xT5gSu9Ch/pvxKjxyRcWkjwLagP5vBy1wAYqifE=;\n\tb=ec40m/WowGEOdJ3CrcQkErp4xN5yxMM3BxpLCfvgPNJF7hUZdSOjsgIw1cX6KmwtTu\n\tOa+pWNHKBiFKbzsdKfAuRLzq/gXHFtykHY1VQtcKupWfIgr93MurHBwqyZkjKxLvKhzx\n\tpP9HTdE32oLIWQJfAHUbu/XI7XL13l3wQUs44=","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to\n\t:references:mime-version:content-transfer-encoding;\n\tbh=S5f6xT5gSu9Ch/pvxKjxyRcWkjwLagP5vBy1wAYqifE=;\n\tb=cJfj7KqPCKOiWH+MxNwa3uWJ7nB8Moo3gMNeeHSc5zTzjteNX3ndRpdBeGFJHcAYev\n\tDk5S/4N7jdM49dwpgyoIDcwD0ZNMDIlhD2hLx9Bw4VDC1bPRHRh2kmpBXSHCDri0mZwQ\n\tM+XuxoouZgaTFFZvyEt9MFMcP83iw36PuKqsj6NqCrZtJkP0yI20QAlqaoeV4WbxvJpH\n\tT1R389m0iLZKq56JJRG6aKVU8K+hNczH+QcUycdS+lk7rIcb1N3W451QA8nWhZumEouM\n\tn5IH//d2SP+QIoC71BERuu0g8g3l01FLVIB6Fp3qa94hBnf1SnUfLJ5xkX4VMNRfglC+\n\t7HDw==","X-Gm-Message-State":"AOAM5334pDq2f/DvoyooQHNqpCAcYwPWAmwzYNA8PExk3a2mFHLflCav\n\ttVJwX2kQPuVyWh6twCYYxIcuFe8SbOvmMw==","X-Google-Smtp-Source":"ABdhPJyQSsCCBE2enulySwrXcD0/f5FG4vuOMzF6R+r4ncU6Bs/qYvFqerklmK6B0+ghNGhKBeBudg==","X-Received":"by 2002:a17:90b:357:: with SMTP id\n\tfh23mr11400789pjb.169.1617328538528; \n\tThu, 01 Apr 2021 18:55:38 -0700 (PDT)","From":"Hirokazu Honda ","To":"libcamera-devel@lists.libcamera.org","Date":"Fri, 2 Apr 2021 10:55:29 +0900","Message-Id":"<20210402015529.1284943-2-hiroh@chromium.org>","X-Mailer":"git-send-email 2.31.0.208.g409f899ff0-goog","In-Reply-To":"<20210402015529.1284943-1-hiroh@chromium.org>","References":"<20210402015529.1284943-1-hiroh@chromium.org>","MIME-Version":"1.0","Subject":"[libcamera-devel] [PATCH v2 2/2] android: CameraDevice: Add more\n\tcamera3_capture_request validation","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "},"content":"This adds more validation to camera3_capture_request mainly\nabout buffer_handle values.\n\nSigned-off-by: Hirokazu Honda \n---\n src/android/camera_device.cpp | 27 ++++++++++++++++++++++++++-\n 1 file changed, 26 insertions(+), 1 deletion(-)","diff":"diff --git a/src/android/camera_device.cpp b/src/android/camera_device.cpp\nindex 988c1fd5..5f9fc169 100644\n--- a/src/android/camera_device.cpp\n+++ b/src/android/camera_device.cpp\n@@ -263,11 +263,36 @@ bool isValidRequest(camera3_capture_request_t *camera3Request)\n \t\treturn false;\n \t}\n \n-\tif (!camera3Request->num_output_buffers) {\n+\tif (!camera3Request->num_output_buffers ||\n+\t !camera3Request->output_buffers) {\n \t\tLOG(HAL, Error) << \"No output buffers provided\";\n \t\treturn false;\n \t}\n \n+\tfor (uint32_t i = 0; i < camera3Request->num_output_buffers; i++) {\n+\t\tconst camera3_stream_buffer_t &outputBuffer =\n+\t\t\tcamera3Request->output_buffers[i];\n+\t\tif (!outputBuffer.buffer || !(*outputBuffer.buffer)) {\n+\t\t\tLOG(HAL, Error) << \"Invalid native handle\";\n+\t\t\treturn false;\n+\t\t}\n+\n+\t\tconst native_handle_t *handle = *outputBuffer.buffer;\n+\t\tconstexpr int kNativeHandleMaxFds = 1024;\n+\t\tif (handle->numFds < 0 || handle->numFds > kNativeHandleMaxFds) {\n+\t\t\tLOG(HAL, Error) << \"Invalid number of fds: \"\n+\t\t\t\t\t<< handle->numFds;\n+\t\t\treturn false;\n+\t\t}\n+\n+\t\tconstexpr int kNativeHandleMaxInts = 1024;\n+\t\tif (handle->numInts < 0 || handle->numInts > kNativeHandleMaxInts) {\n+\t\t\tLOG(HAL, Error) << \"Invalid number of data: \"\n+\t\t\t\t\t<< handle->numInts;\n+\t\t\treturn false;\n+\t\t}\n+\t}\n+\n \treturn true;\n }\n \n","prefixes":["libcamera-devel","v2","2/2"]}