{"id":13968,"url":"https://patchwork.libcamera.org/api/patches/13968/?format=json","web_url":"https://patchwork.libcamera.org/patch/13968/","project":{"id":1,"url":"https://patchwork.libcamera.org/api/projects/1/?format=json","name":"libcamera","link_name":"libcamera","list_id":"libcamera_core","list_email":"libcamera-devel@lists.libcamera.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20210928153634.5864-1-david.plowman@raspberrypi.com>","date":"2021-09-28T15:36:34","name":"[libcamera-devel] libcamera: Fix crash caused by reading uninitialised delayed controls","commit_ref":"a733e0647a2c3cbbacac9110b01afa1e2a2d68d7","pull_url":null,"state":"accepted","archived":false,"hash":"035832d01b23df58674d82645386e5727e0bc220","submitter":{"id":42,"url":"https://patchwork.libcamera.org/api/people/42/?format=json","name":"David Plowman","email":"david.plowman@raspberrypi.com"},"delegate":null,"mbox":"https://patchwork.libcamera.org/patch/13968/mbox/","series":[{"id":2582,"url":"https://patchwork.libcamera.org/api/series/2582/?format=json","web_url":"https://patchwork.libcamera.org/project/libcamera/list/?series=2582","date":"2021-09-28T15:36:34","name":"[libcamera-devel] libcamera: Fix crash caused by reading uninitialised delayed controls","version":1,"mbox":"https://patchwork.libcamera.org/series/2582/mbox/"}],"comments":"https://patchwork.libcamera.org/api/patches/13968/comments/","check":"pending","checks":"https://patchwork.libcamera.org/api/patches/13968/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 8EAA6C3243\n\tfor ;\n\tTue, 28 Sep 2021 15:36:40 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 1021369191;\n\tTue, 28 Sep 2021 17:36:40 +0200 (CEST)","from mail-wm1-x32c.google.com (mail-wm1-x32c.google.com\n\t[IPv6:2a00:1450:4864:20::32c])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 1D1AF69188\n\tfor ;\n\tTue, 28 Sep 2021 17:36:38 +0200 (CEST)","by mail-wm1-x32c.google.com with SMTP id z2so3852826wmc.3\n\tfor ;\n\tTue, 28 Sep 2021 08:36:38 -0700 (PDT)","from pi4-davidp.pitowers.org\n\t([2a00:1098:3142:14:1ce1:9965:4328:89c4])\n\tby smtp.gmail.com with ESMTPSA id\n\td1sm22562735wrr.72.2021.09.28.08.36.36\n\t(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n\tTue, 28 Sep 2021 08:36:36 -0700 (PDT)"],"Authentication-Results":"lancelot.ideasonboard.com;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n\tunprotected) header.d=raspberrypi.com header.i=@raspberrypi.com\n\theader.b=\"DLghld18\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=raspberrypi.com; s=google;\n\th=from:to:cc:subject:date:message-id:mime-version\n\t:content-transfer-encoding;\n\tbh=hpiMk/MuT64ENdNHPVsEEKguezLcZeGm2nzBpX1K8kM=;\n\tb=DLghld18eC4W7yY/Mu4wwFINEn0YjeotgtDd4ObIkoP81l72H+XK4IzwXVCC8Rj6Hv\n\tqsOYKCEEKWH4RhAP1NtAdWvMeL7JBnHU3PWFHdWWK6eFV82DaAsrHxCVnQ8yXhUmv+Nf\n\tbpuxx2CgMXs2QtIKNxJjiOF5nxofWL32GY+DWxCiOL1tUBlLEEbekc7IJ16hhPdg9IIm\n\tYwBq6w1NFnwyltk4/Vk5i+WYXPBiF/wa+D4q45dhMJt6Aa+vOJP5qTZW7hMwYRcr4Jvn\n\tvkNS5rD1XP7gO3b5+Zg3e9Y3HXVHimC0Dd6NfIO9GeSNMRNBZ8C7Khe9mVjUSlITz8s+\n\t2AOQ==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20210112;\n\th=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version\n\t:content-transfer-encoding;\n\tbh=hpiMk/MuT64ENdNHPVsEEKguezLcZeGm2nzBpX1K8kM=;\n\tb=Pahwn/lbCaGHpaH5OnlQ58uTbveqeeUmNSZNdj3NhkiHdChgZjojFZU9zqYCO6/VRk\n\t+KYTJ42hOV1ktHz4nxcF+WDI3tIsnEuh+YaF4TpvpvaztFpeeA/OC+v70Olr1ju1kTeH\n\tRGeAuu2zayY5ksUtTLbI6noxMLLPzJoOItMf7uQBuKrOb1KgbQpzBDRStFBVpAW0LnDF\n\t1KL3eKgxgmz+e061gZG7YCixYwlKpGIr5H6dqwYKFfovtNnM2305m+MkG+kapQU5PKi8\n\t8Ko95j/h6QKkh1gcWWWLeGExnRq4SVHkQbHz4xFuXvFJQ0HEaIf0G2iOcZrTQc1dyUne\n\tlgjg==","X-Gm-Message-State":"AOAM531x4gL9unriKUBNdY9dqXXv1OBfMtzdiK5Ns5HYANM57LrtSae/\n\tGqd2SYLY5Zy0gsBtbmDAhQTvokOt2r/RcP/f","X-Google-Smtp-Source":"ABdhPJxXONvc3AoeI9fSmITTYoORF7bVQO6oUm8kfcww4TwcF8FpnENawY/Btve5UGFTIGo5Q+ITcA==","X-Received":"by 2002:a7b:c409:: with SMTP id k9mr5341122wmi.153.1632843397292;\n\tTue, 28 Sep 2021 08:36:37 -0700 (PDT)","From":"David Plowman ","To":"libcamera-devel@lists.libcamera.org","Date":"Tue, 28 Sep 2021 16:36:34 +0100","Message-Id":"<20210928153634.5864-1-david.plowman@raspberrypi.com>","X-Mailer":"git-send-email 2.20.1","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","Subject":"[libcamera-devel] [PATCH] libcamera: Fix crash caused by reading\n\tuninitialised delayed controls","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "},"content":"This fixes bug https://bugs.libcamera.org/show_bug.cgi?id=74.\n\nThe cause is that we read out delayed values using a frame's sequence\nnumber (DelayedControls::get). But we fill the values up\n(DelayedControls::applyControls) incrementing writeCount by only one\neven if the sequence number has jumped by several since last\ntime. This is exactly what happens when frames are being dropped.\n\nSo the fix is to increment writeCount by \"as much as the sequence\nnumber has jumped since last time\", which means that we just follow\nthe sequence number directly.\n\nSigned-off-by: David Plowman \n---\n src/libcamera/delayed_controls.cpp | 2 +-\n 1 file changed, 1 insertion(+), 1 deletion(-)","diff":"diff --git a/src/libcamera/delayed_controls.cpp b/src/libcamera/delayed_controls.cpp\nindex 90ce7e0b..9667187e 100644\n--- a/src/libcamera/delayed_controls.cpp\n+++ b/src/libcamera/delayed_controls.cpp\n@@ -279,7 +279,7 @@ void DelayedControls::applyControls(uint32_t sequence)\n \t\t}\n \t}\n \n-\twriteCount_++;\n+\twriteCount_ = sequence - firstSequence_ + 1;\n \n \twhile (writeCount_ > queueCount_) {\n \t\tLOG(DelayedControls, Debug)\n","prefixes":["libcamera-devel"]}