{"id":11824,"url":"https://patchwork.libcamera.org/api/patches/11824/?format=json","web_url":"https://patchwork.libcamera.org/patch/11824/","project":{"id":1,"url":"https://patchwork.libcamera.org/api/projects/1/?format=json","name":"libcamera","link_name":"libcamera","list_id":"libcamera_core","list_email":"libcamera-devel@lists.libcamera.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20210402024452.1308253-2-hiroh@chromium.org>","date":"2021-04-02T02:44:52","name":"[libcamera-devel,v3,2/2] android: CameraDevice: Add more camera3_capture_request validation","commit_ref":null,"pull_url":null,"state":"changes-requested","archived":false,"hash":"216c8eca5412fc411d0b6f30ac4139a958893599","submitter":{"id":63,"url":"https://patchwork.libcamera.org/api/people/63/?format=json","name":"Hirokazu Honda","email":"hiroh@chromium.org"},"delegate":null,"mbox":"https://patchwork.libcamera.org/patch/11824/mbox/","series":[{"id":1883,"url":"https://patchwork.libcamera.org/api/series/1883/?format=json","web_url":"https://patchwork.libcamera.org/project/libcamera/list/?series=1883","date":"2021-04-02T02:44:51","name":"[libcamera-devel,v3,1/2] android: cameraDevice: Factorize the code of validating camera3_capture_request","version":3,"mbox":"https://patchwork.libcamera.org/series/1883/mbox/"}],"comments":"https://patchwork.libcamera.org/api/patches/11824/comments/","check":"pending","checks":"https://patchwork.libcamera.org/api/patches/11824/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id ECA36C0DA3\n\tfor ;\n\tFri, 2 Apr 2021 02:45:03 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id AD89D6878A;\n\tFri, 2 Apr 2021 04:45:03 +0200 (CEST)","from mail-pg1-x531.google.com (mail-pg1-x531.google.com\n\t[IPv6:2607:f8b0:4864:20::531])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id AC10B68781\n\tfor ;\n\tFri, 2 Apr 2021 04:45:01 +0200 (CEST)","by mail-pg1-x531.google.com with SMTP id j34so766648pgj.12\n\tfor ;\n\tThu, 01 Apr 2021 19:45:01 -0700 (PDT)","from hiroh2.tok.corp.google.com\n\t([2401:fa00:8f:2:908:1da:b07c:32bc])\n\tby smtp.gmail.com with ESMTPSA id\n\tbb16sm145361pjb.17.2021.04.01.19.44.58\n\t(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n\tThu, 01 Apr 2021 19:44:59 -0700 (PDT)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n\tunprotected) header.d=chromium.org header.i=@chromium.org\n\theader.b=\"Y7LnUGsb\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org;\n\ts=google; \n\th=from:to:cc:subject:date:message-id:in-reply-to:references\n\t:mime-version:content-transfer-encoding;\n\tbh=1ztDffAkupvDY6/wmiELYvV77Eggfxt5FD5d8zGbSd4=;\n\tb=Y7LnUGsbAHOKaQUduT8nXQbQ9lXmt94CAYjzs9Kmgl6E2P0ldEVpiPYJrCELrcM7D4\n\tmImMKs357HmbM54BKZr5cSG8taFdojRNvVOCYVLp+fdR0E/AdiE8mPSuNaD8zkNGChh6\n\tIY0Fvq9ZKqDl1/DP2zakbW0xgtos9TP0svMck=","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to\n\t:references:mime-version:content-transfer-encoding;\n\tbh=1ztDffAkupvDY6/wmiELYvV77Eggfxt5FD5d8zGbSd4=;\n\tb=k2rdudVatY4eIPI4zSDbq98z+arkcG0c6fBnyPRuAvyuDYgfuWzpVrdmVfPyQltGcp\n\t3+Rp0iB/7tQTwIZDL2WvAx5C8sjJZkHi/47bcOwNpyI0Rk/wt+3kNqpwMrOYThq5+BGN\n\tnPjIJSvMoEotwjXvWDH3sWKBnIR+sZXG/uLkv8AZpFBz2fr96g+b9TJUATPiNVIDsJ39\n\tuEu1PvRM4Ys1PXCtNqkPQBgWsK4n6vuxgk30GYm55Lf/QihLPtbKu8/+8f5UmseYg0xV\n\tlwTMUaw42FZeJA78XLGo5k9eGmgdz8h4UPU70759VJuuaYGd2dcXQaS1p5CM54C5UssU\n\tylRQ==","X-Gm-Message-State":"AOAM533wqjLF5JNhYaui9y97LcWSIODbQqE3ZfFAY71kUWkI1+p5j2mf\n\tvCLZcgAcctb51RgBRtQIYAHisUORLoUFJg==","X-Google-Smtp-Source":"ABdhPJzaSWFuX1uCaX37HpaFCq7j30E0klt/0Ax4cNR5RNvK8I0DOv+AP+Cw9F5z5LSHD79w90cubA==","X-Received":"by 2002:a63:1203:: with SMTP id\n\th3mr10165767pgl.223.1617331499788; \n\tThu, 01 Apr 2021 19:44:59 -0700 (PDT)","From":"Hirokazu Honda ","To":"libcamera-devel@lists.libcamera.org","Date":"Fri, 2 Apr 2021 11:44:52 +0900","Message-Id":"<20210402024452.1308253-2-hiroh@chromium.org>","X-Mailer":"git-send-email 2.31.0.208.g409f899ff0-goog","In-Reply-To":"<20210402024452.1308253-1-hiroh@chromium.org>","References":"<20210402024452.1308253-1-hiroh@chromium.org>","MIME-Version":"1.0","Subject":"[libcamera-devel] [PATCH v3 2/2] android: CameraDevice: Add more\n\tcamera3_capture_request validation","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "},"content":"This adds more validation to camera3_capture_request mainly\nabout buffer_handle values.\n\nSigned-off-by: Hirokazu Honda \n---\n src/android/camera_device.cpp | 29 +++++++++++++++++++++++++++--\n 1 file changed, 27 insertions(+), 2 deletions(-)","diff":"diff --git a/src/android/camera_device.cpp b/src/android/camera_device.cpp\nindex 988c1fd5..8b6032fc 100644\n--- a/src/android/camera_device.cpp\n+++ b/src/android/camera_device.cpp\n@@ -263,11 +263,36 @@ bool isValidRequest(camera3_capture_request_t *camera3Request)\n \t\treturn false;\n \t}\n \n-\tif (!camera3Request->num_output_buffers) {\n+\tif (!camera3Request->num_output_buffers ||\n+\t !camera3Request->output_buffers) {\n \t\tLOG(HAL, Error) << \"No output buffers provided\";\n \t\treturn false;\n \t}\n \n+\tfor (uint32_t i = 0; i < camera3Request->num_output_buffers; i++) {\n+\t\tconst camera3_stream_buffer_t &outputBuffer =\n+\t\t\tcamera3Request->output_buffers[i];\n+\t\tif (!outputBuffer.buffer || !(*outputBuffer.buffer)) {\n+\t\t\tLOG(HAL, Error) << \"Invalid native handle\";\n+\t\t\treturn false;\n+\t\t}\n+\n+\t\tconst native_handle_t *handle = *outputBuffer.buffer;\n+\t\tconstexpr int kNativeHandleMaxFds = 1024;\n+\t\tif (handle->numFds < 0 || handle->numFds > kNativeHandleMaxFds) {\n+\t\t\tLOG(HAL, Error) << \"Invalid number of fds: \"\n+\t\t\t\t\t<< handle->numFds;\n+\t\t\treturn false;\n+\t\t}\n+\n+\t\tconstexpr int kNativeHandleMaxInts = 1024;\n+\t\tif (handle->numInts < 0 || handle->numInts > kNativeHandleMaxInts) {\n+\t\t\tLOG(HAL, Error) << \"Invalid number of data: \"\n+\t\t\t\t\t<< handle->numInts;\n+\t\t\treturn false;\n+\t\t}\n+\t}\n+\n \treturn true;\n }\n \n@@ -1800,7 +1825,7 @@ int CameraDevice::processControls(Camera3RequestDescriptor *descriptor)\n \n int CameraDevice::processCaptureRequest(camera3_capture_request_t *camera3Request)\n {\n-\tif (isValidRequest(camera3Request))\n+\tif (!isValidRequest(camera3Request))\n \t\treturn -EINVAL;\n \n \t/* Start the camera if that's the first request we handle. */\n","prefixes":["libcamera-devel","v3","2/2"]}