[{"id":2293,"web_url":"https://patchwork.libcamera.org/comment/2293/","msgid":"<20190718135829.GC8641@pendragon.ideasonboard.com>","date":"2019-07-18T13:58:29","subject":"Re: [libcamera-devel] [PATCH] test: camera: buffer_import: clear\n\tvideo pointer","submitter":{"id":2,"url":"https://patchwork.libcamera.org/api/people/2/","name":"Laurent Pinchart","email":"laurent.pinchart@ideasonboard.com"},"content":"Hi Kieran,\n\nThank you for the patch.\n\nOn Thu, Jul 18, 2019 at 05:28:05AM +0100, Kieran Bingham wrote:\n> The FrameSink::cleanup() call checks if video_ is set before cleaning up\n> and then deleting the object.\n> \n> If the cleanup() call is called twice for any reason, this will\n> encounter a use-after-free as the video_ pointer is not cleared after\n> deletion.\n> \n> Whilst cleanup() is not currently called twice consecutively, to prevent\n> errors in the future, make it explicit that the object has been deleted\n> by clearing the stale pointer.\n> \n> Signed-off-by: Kieran Bingham \n\nIt's test code so it doesn't matter much, but it doesn't hurt either, so\n\nReviewed-by: Laurent Pinchart \n\n> ---\n> test/camera/buffer_import.cpp | 2 ++\n> 1 file changed, 2 insertions(+)\n> \n> diff --git a/test/camera/buffer_import.cpp b/test/camera/buffer_import.cpp\n> index d6e4fd5bf6ad..400d02b350c1 100644\n> --- a/test/camera/buffer_import.cpp\n> +++ b/test/camera/buffer_import.cpp\n> @@ -109,7 +109,9 @@ public:\n> \t\t\tvideo_->streamOff();\n> \t\t\tvideo_->releaseBuffers();\n> \t\t\tvideo_->close();\n> +\n> \t\t\tdelete video_;\n> +\t\t\tvideo_ = nullptr;\n> \t\t}\n> \n> \t\tif (media_)","headers":{"Return-Path":"","Received":["from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[213.167.242.64])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 5168960BE1\n\tfor ;\n\tThu, 18 Jul 2019 15:58:34 +0200 (CEST)","from pendragon.ideasonboard.com (softbank126159220198.bbtec.net\n\t[126.159.220.198])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id 21FAA31C;\n\tThu, 18 Jul 2019 15:58:32 +0200 (CEST)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1563458314;\n\tbh=XYZFRy8hPn/LNNFYWiCKgHMyCLcmTOA7O+WXoi4WtMQ=;\n\th=Date:From:To:Cc:Subject:References:In-Reply-To:From;\n\tb=chn2MtgzjcJR2f98Nqvn+06H/jBRVIcUn+Drib+RK6sL+cRJOI40bMhLif68Z1wHs\n\tF9kkruXUF3WV9imX04yx59Vo6iAoNc4Z6nVSYImXNIwHAGMr+/BDU7cB/A3HpVoLzT\n\tbKUC2u/7ra9BHGuxapVTbUVEevEUOY5n1/5U0YN8=","Date":"Thu, 18 Jul 2019 16:58:29 +0300","From":"Laurent Pinchart ","To":"Kieran Bingham ","Cc":"LibCamera Devel ","Message-ID":"<20190718135829.GC8641@pendragon.ideasonboard.com>","References":"<20190718042805.26595-1-kieran.bingham@ideasonboard.com>","MIME-Version":"1.0","Content-Type":"text/plain; charset=utf-8","Content-Disposition":"inline","In-Reply-To":"<20190718042805.26595-1-kieran.bingham@ideasonboard.com>","User-Agent":"Mutt/1.10.1 (2018-07-13)","Subject":"Re: [libcamera-devel] [PATCH] test: camera: buffer_import: clear\n\tvideo pointer","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.23","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","X-List-Received-Date":"Thu, 18 Jul 2019 13:58:34 -0000"}},{"id":2302,"web_url":"https://patchwork.libcamera.org/comment/2302/","msgid":"<20190720132327.GK1679@wyvern>","date":"2019-07-20T13:23:27","subject":"Re: [libcamera-devel] [PATCH] test: camera: buffer_import: clear\n\tvideo pointer","submitter":{"id":5,"url":"https://patchwork.libcamera.org/api/people/5/","name":"Niklas Söderlund","email":"niklas.soderlund@ragnatech.se"},"content":"Hi Kieran,\n\nThanks for your work.\n\nOn 2019-07-18 05:28:05 +0100, Kieran Bingham wrote:\n> The FrameSink::cleanup() call checks if video_ is set before cleaning up\n> and then deleting the object.\n> \n> If the cleanup() call is called twice for any reason, this will\n> encounter a use-after-free as the video_ pointer is not cleared after\n> deletion.\n> \n> Whilst cleanup() is not currently called twice consecutively, to prevent\n> errors in the future, make it explicit that the object has been deleted\n> by clearing the stale pointer.\n> \n> Signed-off-by: Kieran Bingham \n\nReviewed-by: Niklas Söderlund \n\n> ---\n> test/camera/buffer_import.cpp | 2 ++\n> 1 file changed, 2 insertions(+)\n> \n> diff --git a/test/camera/buffer_import.cpp b/test/camera/buffer_import.cpp\n> index d6e4fd5bf6ad..400d02b350c1 100644\n> --- a/test/camera/buffer_import.cpp\n> +++ b/test/camera/buffer_import.cpp\n> @@ -109,7 +109,9 @@ public:\n> \t\t\tvideo_->streamOff();\n> \t\t\tvideo_->releaseBuffers();\n> \t\t\tvideo_->close();\n> +\n> \t\t\tdelete video_;\n> +\t\t\tvideo_ = nullptr;\n> \t\t}\n> \n> \t\tif (media_)\n> -- \n> 2.20.1\n> \n> _______________________________________________\n> libcamera-devel mailing list\n> libcamera-devel@lists.libcamera.org\n> https://lists.libcamera.org/listinfo/libcamera-devel","headers":{"Return-Path":"","Received":["from mail-pf1-x443.google.com (mail-pf1-x443.google.com\n\t[IPv6:2607:f8b0:4864:20::443])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 7E8C860C00\n\tfor ;\n\tSat, 20 Jul 2019 15:23:31 +0200 (CEST)","by mail-pf1-x443.google.com with SMTP id b13so15363808pfo.1\n\tfor ;\n\tSat, 20 Jul 2019 06:23:31 -0700 (PDT)","from localhost (M106185144154.v4.enabler.ne.jp. [106.185.144.154])\n\tby smtp.gmail.com with ESMTPSA id\n\ts43sm37086786pjb.10.2019.07.20.06.23.29\n\t(version=TLS1_3 cipher=AEAD-AES256-GCM-SHA384 bits=256/256);\n\tSat, 20 Jul 2019 06:23:29 -0700 (PDT)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=ragnatech-se.20150623.gappssmtp.com; s=20150623;\n\th=date:from:to:cc:subject:message-id:references:mime-version\n\t:content-disposition:content-transfer-encoding:in-reply-to\n\t:user-agent; bh=0i3Hve2IfOoyJNuc7j341+8I0onqYEZ1wwb86SO2E0s=;\n\tb=axarTcel1GHUwd+G6T1WTff/9zlEpqifqfFXdmpaLlbsX23zwu2KQvCdrLA4whHIMk\n\tSUVxMJ6Ei5KnUvGMDSZBbWZNTjYM3foi+MP2C4FMfsS49eCd8WkMYJptY5T8N4RG9+k3\n\tcFcmRumFbKuwIlAQo1CufL8TKMI4f8+BM+o4/zsq9aWuuBK7l/rXOzXfpSrxLmyCyCpt\n\tEHHU4hacyqzoXNx8jNsHv6tsQFfFSnEkxuHyjkY45Y6/RAOaqmMZkE30s1fEKOjdr6tQ\n\td8BKWLqZcXOGcYAqtyV/ni+PmOMFdD2EnG6aBzDD8OchKCJl2fKV8IMU0j3jreTeuc9E\n\tYqtA==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:date:from:to:cc:subject:message-id:references\n\t:mime-version:content-disposition:content-transfer-encoding\n\t:in-reply-to:user-agent;\n\tbh=0i3Hve2IfOoyJNuc7j341+8I0onqYEZ1wwb86SO2E0s=;\n\tb=tg7Uf+jQihnT41jT4wCN6JvriPYNgUIxRGLAg3eC5hfzPk/oMXdlJWLLwB7D58/J2W\n\t24ryCnmLNiaD9rEirFrY4r7MqWbyhGSHsihx5tM/gdWVeXlQ5RnqwH0cZxenlFdERXek\n\twAHVfn3Wo+V1Lf+IcSVmopIdYX7egBY9218ApEBy/7WoynAuNQT22OhlBJfmC2cWmNLC\n\tq4ajOc3rD25HfnwNFmyBxlFdl5iBG2Yl3ESjnpeMUHqACtrrfXkoR3jj2QT871vMJ9VR\n\tDxBYMh2eIoUpje5XlpRQ2D+QtVU2XlI2uGqrIPwp6zZtO+ortldTQTgxyRxXY9edb43k\n\t23uw==","X-Gm-Message-State":"APjAAAUuZRdZk70ugg0HWZcf8jXj8DW09P6cW6JRiP/aXlxR8bvxBhi/\n\taBZyjGhRgf7hd8MRigfOzwQ=","X-Google-Smtp-Source":"APXvYqzMGkbYS/h9B4oTtY2kL/18q3eRl0MvOQ85uBvGFHEYdSmm94BUu3r9aX3zi/XTMG3Nvi1tfA==","X-Received":"by 2002:a65:6497:: with SMTP id\n\te23mr57727789pgv.89.1563629010198; \n\tSat, 20 Jul 2019 06:23:30 -0700 (PDT)","Date":"Sat, 20 Jul 2019 22:23:27 +0900","From":"Niklas =?iso-8859-1?q?S=F6derlund?= ","To":"Kieran Bingham ","Cc":"LibCamera Devel ","Message-ID":"<20190720132327.GK1679@wyvern>","References":"<20190718042805.26595-1-kieran.bingham@ideasonboard.com>","MIME-Version":"1.0","Content-Type":"text/plain; charset=iso-8859-1","Content-Disposition":"inline","Content-Transfer-Encoding":"8bit","In-Reply-To":"<20190718042805.26595-1-kieran.bingham@ideasonboard.com>","User-Agent":"Mutt/1.12.1 (2019-06-15)","Subject":"Re: [libcamera-devel] [PATCH] test: camera: buffer_import: clear\n\tvideo pointer","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.23","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","X-List-Received-Date":"Sat, 20 Jul 2019 13:23:31 -0000"}}]