Patch Detail
Show a patch.
GET /api/patches/27495/?format=api
{ "id": 27495, "url": "https://patchwork.libcamera.org/api/patches/27495/?format=api", "web_url": "https://patchwork.libcamera.org/patch/27495/", "project": { "id": 1, "url": "https://patchwork.libcamera.org/api/projects/1/?format=api", "name": "libcamera", "link_name": "libcamera", "list_id": "libcamera_core", "list_email": "libcamera-devel@lists.libcamera.org", "web_url": "", "scm_url": "", "webscm_url": "" }, "msgid": "<20260723174644.6580-3-magdum.foss@gmail.com>", "date": "2026-07-23T17:46:44", "name": "[2/2] libcamera: Harden control serializer size and input validation", "commit_ref": null, "pull_url": null, "state": "superseded", "archived": false, "hash": "1b67c4293f7afb367f89b7002e03187e56624f73", "submitter": { "id": 453, "url": "https://patchwork.libcamera.org/api/people/453/?format=api", "name": "Magdum", "email": "magdum.foss@gmail.com" }, "delegate": null, "mbox": "https://patchwork.libcamera.org/patch/27495/mbox/", "series": [ { "id": 6076, "url": "https://patchwork.libcamera.org/api/series/6076/?format=api", "web_url": "https://patchwork.libcamera.org/project/libcamera/list/?series=6076", "date": "2026-07-23T17:46:42", "name": "libcamera: Control name serialization v3 and input validation hardening", "version": 1, "mbox": "https://patchwork.libcamera.org/series/6076/mbox/" } ], "comments": "https://patchwork.libcamera.org/api/patches/27495/comments/", "check": "pending", "checks": "https://patchwork.libcamera.org/api/patches/27495/checks/", "tags": {}, "headers": { "Return-Path": "<libcamera-devel-bounces@lists.libcamera.org>", "X-Original-To": "parsemail@patchwork.libcamera.org", "Delivered-To": "parsemail@patchwork.libcamera.org", "Received": [ "from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id CAD96BDE17\n\tfor <parsemail@patchwork.libcamera.org>;\n\tThu, 23 Jul 2026 17:47:00 +0000 (UTC)", "from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 7CA5167ED8;\n\tThu, 23 Jul 2026 19:47:00 +0200 (CEST)", "from mail-wr1-x432.google.com (mail-wr1-x432.google.com\n\t[IPv6:2a00:1450:4864:20::432])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id E864A67ED2\n\tfor <libcamera-devel@lists.libcamera.org>;\n\tThu, 23 Jul 2026 19:46:58 +0200 (CEST)", "by mail-wr1-x432.google.com with SMTP id\n\tffacd0b85a97d-472326ca506so675538f8f.2\n\tfor <libcamera-devel@lists.libcamera.org>;\n\tThu, 23 Jul 2026 10:46:58 -0700 (PDT)", "from magdum-System-Product-Name.vodafone.ultrahub\n\t([2a02:810d:4b14:4600:72e8:99a4:5b87:2e43])\n\tby smtp.gmail.com with ESMTPSA id\n\tffacd0b85a97d-47f85c67339sm18199270f8f.31.2026.07.23.10.46.57\n\t(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n\tThu, 23 Jul 2026 10:46:57 -0700 (PDT)" ], "Authentication-Results": "lancelot.ideasonboard.com; dkim=pass (2048-bit key;\n\tunprotected) header.d=gmail.com header.i=@gmail.com\n\theader.b=\"PUVhJqoh\"; dkim-atps=neutral", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=gmail.com; s=20251104; t=1784828818; x=1785433618;\n\tdarn=lists.libcamera.org; \n\th=content-transfer-encoding:mime-version:references:in-reply-to\n\t:message-id:date:subject:cc:to:from:from:to:cc:subject:date\n\t:message-id:reply-to:content-type;\n\tbh=IDxAOnA7ZYDzq2jbB96zXS1bZl6bPgJG8fFpAKQipDQ=;\n\tb=PUVhJqohXp0vp8squbVypByC8O9LCPU6zYjDcjOnwBHPPeJhuK1m5Pv8dBzO7p/Yia\n\tcc/fkiHK1/OziZw7Q1Dk0nUImDsjUO4WDOPQL99AxL7ifoRyRI2j7iPBGfOqtU1HKIxt\n\tM+uRnwIJFQlg+M2nZcZiOBBdMDffuhD777soumam2OWcJk9lxw/KBiDNgjCWMnhw33df\n\tFuZvx3EFdd/zsufm6exX3hrXVywck1vxVDTsQ5fGsbo1Y4T0KoL593ddaBtqq/BRsDxc\n\tz1+SfUSfzlk2DSiPr13nGiGVC9slHDSogAki+5+NcjCpAdyJKKISy3DpKQ0DcpL/eZXj\n\tfdpQ==", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20251104; t=1784828818; x=1785433618;\n\th=content-transfer-encoding:mime-version:references:in-reply-to\n\t:message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from\n\t:to:cc:subject:date:message-id:reply-to:content-type;\n\tbh=IDxAOnA7ZYDzq2jbB96zXS1bZl6bPgJG8fFpAKQipDQ=;\n\tb=VLSx6Ci9skceoYoi7JI7r9XW0jEaSGFWhAiosPCP+0EnYuF21Hxe3zCaBb7D1nYBmk\n\tiDGiHOt9IGPTXehBzsC3UVyD9xyBCj64ApGoeu0MRQpu9XAsSGeOvCVG10ByM9PN86r0\n\tLwvmqt/oTnTjpBezW1hVPfGvqK4FLnnzphtOf6IQLD4Wb+ZURsnDzScyP93SfjYKFuzQ\n\t1fsVbJOi1WhkU9hhTglZv+yMsAAn70EsTDQxDvsk5Bs0fqJYS3HK4ls+D/Rh2oKDjjLb\n\tl+YNWb5pJUgkWAjgq1qLcmQwyOFay46cgWLrbMF5J6pH7wveaIJ7iOUlZJmDziBxUviP\n\ta/sw==", "X-Gm-Message-State": "AOJu0Yy2Zukg5O37+3MyA2SMr7ez28AkY8jE690GTS4A+dmYNkV9qmA+\n\tEM5lCVAkSNQ2sWYmlpEuItQbXpSk0cYpDXkYxQxGbIYfgf21Lz+CXrEfRLHtM7ZqvZk=", "X-Gm-Gg": "AR+sD12UGmfUzG5gUhv1iCUN1QKaJs0+myIrRqYM4sDBbuorMYaDKSUZmPIMdfy2X8Q\n\teSZBtJeXQfUm0hE/ozFZcWxtZ0A4baIKfofDRS+Tq0XQv+YH3vG72K4Rct0b7eNJO5qsEFdfaA1\n\tZ+yoSsHJ1KbbhJNd70DIEmFkZnikk9sdzxgKoYKcl4OJOl5QLevmaSLc8gFpZ6GffYGrajYF5z+\n\tS6aAJrFGdFiA7ZFMm99Du/T5MSVxAC9VUwyiiWKzBR/AzlFy8MaVXLalS4MNmEVFPRkN5fNoRCB\n\tTbkTvrSMqlszvfyMjjHcoydGfAbS+P/RBL6pUmeWhdqN6vdfd/O78HbqqAVWnwqxPa49EnAxUwr\n\t0hPKFFYNCETNkM+iAsWVHmsnoBWJEhaZKNVQYqxtMAbwiLfz6p5PLETEwTDJ4LMRU0S79k0iWER\n\trZa+rx5n51Qfdth8rDn3dNG7bIynbxSKkqoEF7YA==", "X-Received": "by 2002:a05:6000:184b:b0:475:f0f0:9eed with SMTP id\n\tffacd0b85a97d-47f8d760185mr5540701f8f.50.1784828818307; \n\tThu, 23 Jul 2026 10:46:58 -0700 (PDT)", "From": "Magdum <magdum.foss@gmail.com>", "To": "libcamera-devel@lists.libcamera.org", "Cc": "Magdum <magdum.foss@gmail.com>", "Subject": "[PATCH 2/2] libcamera: Harden control serializer size and input\n\tvalidation", "Date": "Thu, 23 Jul 2026 19:46:44 +0200", "Message-ID": "<20260723174644.6580-3-magdum.foss@gmail.com>", "X-Mailer": "git-send-email 2.43.0", "In-Reply-To": "<20260723174644.6580-1-magdum.foss@gmail.com>", "References": "<20260723174644.6580-1-magdum.foss@gmail.com>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "X-BeenThere": "libcamera-devel@lists.libcamera.org", "X-Mailman-Version": "2.1.29", "Precedence": "list", "List-Id": "<libcamera-devel.lists.libcamera.org>", "List-Unsubscribe": "<https://lists.libcamera.org/options/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=unsubscribe>", "List-Archive": "<https://lists.libcamera.org/pipermail/libcamera-devel/>", "List-Post": "<mailto:libcamera-devel@lists.libcamera.org>", "List-Help": "<mailto:libcamera-devel-request@lists.libcamera.org?subject=help>", "List-Subscribe": "<https://lists.libcamera.org/listinfo/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=subscribe>", "Errors-To": "libcamera-devel-bounces@lists.libcamera.org", "Sender": "\"libcamera-devel\" <libcamera-devel-bounces@lists.libcamera.org>" }, "content": "Add overflow-safe size computations before writing 32-bit wire fields,\ncentralize control-name size accounting, and validate deserialized\nlocal control direction values.\n\nStrengthen tests with alignment-safe packet mutation, deterministic\nbad-terminator corruption, and max-length control-name boundary\ncoverage.\n\nDocument binarySize() overflow sentinel semantics in the internal\nserializer header.\n\nSigned-off-by: Magdum <magdum.foss@gmail.com>\n---\n src/libcamera/control_serializer.cpp | 222 ++++++++++++++++---\n test/serialization/control_serialization.cpp | 77 ++++++-\n 2 files changed, 268 insertions(+), 31 deletions(-)", "diff": "diff --git a/src/libcamera/control_serializer.cpp b/src/libcamera/control_serializer.cpp\nindex b3c44ed0..076e78c5 100644\n--- a/src/libcamera/control_serializer.cpp\n+++ b/src/libcamera/control_serializer.cpp\n@@ -8,6 +8,7 @@\n #include \"libcamera/internal/control_serializer.h\"\n \n #include <algorithm>\n+#include <limits>\n #include <memory>\n #include <vector>\n \n@@ -50,6 +51,58 @@ bool idMapRequiresLocalIds(enum ipa_controls_id_map_type idMapType)\n \treturn idMapType == IPA_CONTROL_ID_MAP_V4L2;\n }\n \n+size_t serializedControlNameSize(const ControlId *id,\n+\t\t\t\t enum ipa_controls_id_map_type idMapType)\n+{\n+\treturn idMapRequiresLocalIds(idMapType) ? id->name().size() + 1 : 1;\n+}\n+\n+bool fitsU32(size_t value)\n+{\n+\treturn value <= std::numeric_limits<uint32_t>::max();\n+}\n+\n+bool safeMulSizeT(size_t lhs, size_t rhs, size_t *out)\n+{\n+\tif (!lhs || !rhs) {\n+\t\t*out = 0;\n+\t\treturn true;\n+\t}\n+\n+\tif (lhs > std::numeric_limits<size_t>::max() / rhs)\n+\t\treturn false;\n+\n+\t*out = lhs * rhs;\n+\treturn true;\n+}\n+\n+bool safeAddSizeT(size_t lhs, size_t rhs, size_t *out)\n+{\n+\tif (lhs > std::numeric_limits<size_t>::max() - rhs)\n+\t\treturn false;\n+\n+\t*out = lhs + rhs;\n+\treturn true;\n+}\n+\n+bool isValidDirection(uint8_t direction)\n+{\n+\tconstexpr uint8_t kDirectionIn =\n+\t\tstatic_cast<uint8_t>(ControlId::Direction::In);\n+\tconstexpr uint8_t kDirectionOut =\n+\t\tstatic_cast<uint8_t>(ControlId::Direction::Out);\n+\tconstexpr uint8_t kDirectionInOut = kDirectionIn | kDirectionOut;\n+\n+\tswitch (direction) {\n+\tcase kDirectionIn:\n+\tcase kDirectionOut:\n+\tcase kDirectionInOut:\n+\t\treturn true;\n+\tdefault:\n+\t\treturn false;\n+\t}\n+}\n+\n } /* namespace */\n \n /**\n@@ -184,16 +237,26 @@ size_t ControlSerializer::binarySize(const ControlInfo &info)\n */\n size_t ControlSerializer::binarySize(const ControlInfoMap &infoMap)\n {\n-\tsize_t size = sizeof(struct ipa_controls_header)\n-\t\t + infoMap.size() * sizeof(struct ipa_control_info_entry);\n+\tsize_t entriesSize;\n+\tif (!safeMulSizeT(infoMap.size(), sizeof(struct ipa_control_info_entry),\n+\t\t\t &entriesSize))\n+\t\treturn std::numeric_limits<size_t>::max();\n+\n+\tsize_t size;\n+\tif (!safeAddSizeT(sizeof(struct ipa_controls_header), entriesSize, &size))\n+\t\treturn std::numeric_limits<size_t>::max();\n \tenum ipa_controls_id_map_type idMapType = idMapTypeFor(infoMap.idmap());\n \n \tfor (const auto &ctrl : infoMap) {\n-\t\tsize += binarySize(ctrl.second);\n-\n-\t\tsize += idMapRequiresLocalIds(idMapType)\n-\t\t\t\t? ctrl.first->name().size() + 1\n-\t\t\t\t: 1;\n+\t\tsize_t nextSize;\n+\t\tif (!safeAddSizeT(size, binarySize(ctrl.second), &nextSize))\n+\t\t\treturn std::numeric_limits<size_t>::max();\n+\t\tsize = nextSize;\n+\n+\t\tsize_t nameSize = serializedControlNameSize(ctrl.first, idMapType);\n+\t\tif (!safeAddSizeT(size, nameSize, &nextSize))\n+\t\t\treturn std::numeric_limits<size_t>::max();\n+\t\tsize = nextSize;\n \t}\n \n \treturn size;\n@@ -210,10 +273,21 @@ size_t ControlSerializer::binarySize(const ControlInfoMap &infoMap)\n */\n size_t ControlSerializer::binarySize(const ControlList &list)\n {\n-\tsize_t size = sizeof(struct ipa_controls_header) + list.size() * sizeof(struct ipa_control_list_entry);\n+\tsize_t entriesSize;\n+\tif (!safeMulSizeT(list.size(), sizeof(struct ipa_control_list_entry),\n+\t\t\t &entriesSize))\n+\t\treturn std::numeric_limits<size_t>::max();\n \n-\tfor (const auto &ctrl : list)\n-\t\tsize += binarySize(ctrl.second);\n+\tsize_t size;\n+\tif (!safeAddSizeT(sizeof(struct ipa_controls_header), entriesSize, &size))\n+\t\treturn std::numeric_limits<size_t>::max();\n+\n+\tfor (const auto &ctrl : list) {\n+\t\tsize_t nextSize;\n+\t\tif (!safeAddSizeT(size, binarySize(ctrl.second), &nextSize))\n+\t\t\treturn std::numeric_limits<size_t>::max();\n+\t\tsize = nextSize;\n+\t}\n \n \treturn size;\n }\n@@ -260,23 +334,70 @@ int ControlSerializer::serialize(const ControlInfoMap &infoMap,\n \tenum ipa_controls_id_map_type idMapType = idMapTypeFor(infoMap.idmap());\n \n \t/* Compute entries and data required sizes. */\n-\tsize_t entriesSize = infoMap.size()\n-\t\t\t * sizeof(struct ipa_control_info_entry);\n+\tsize_t entriesSize;\n+\tif (!safeMulSizeT(infoMap.size(), sizeof(struct ipa_control_info_entry),\n+\t\t\t &entriesSize)) {\n+\t\tLOG(Serializer, Error)\n+\t\t\t<< \"ControlInfoMap entries size overflows\";\n+\t\treturn -E2BIG;\n+\t}\n+\n \tsize_t valuesSize = 0;\n \tfor (const auto &ctrl : infoMap) {\n-\t\tvaluesSize += binarySize(ctrl.second);\n-\t\tvaluesSize += idMapRequiresLocalIds(idMapType)\n-\t\t\t\t ? ctrl.first->name().size() + 1\n-\t\t\t\t : 1;\n+\t\tsize_t valueSize = binarySize(ctrl.second);\n+\t\tsize_t nextValuesSize;\n+\t\tif (!safeAddSizeT(valuesSize, valueSize, &nextValuesSize)) {\n+\t\t\tLOG(Serializer, Error)\n+\t\t\t\t<< \"ControlInfoMap values size overflows\";\n+\t\t\treturn -E2BIG;\n+\t\t}\n+\t\tvaluesSize = nextValuesSize;\n+\n+\t\tsize_t nameSize = serializedControlNameSize(ctrl.first, idMapType);\n+\t\tif (!safeAddSizeT(valuesSize, nameSize, &nextValuesSize)) {\n+\t\t\tLOG(Serializer, Error)\n+\t\t\t\t<< \"ControlInfoMap names size overflows\";\n+\t\t\treturn -E2BIG;\n+\t\t}\n+\t\tvaluesSize = nextValuesSize;\n+\t}\n+\n+\tif (!fitsU32(infoMap.size()) || !fitsU32(entriesSize) ||\n+\t !fitsU32(valuesSize)) {\n+\t\tLOG(Serializer, Error)\n+\t\t\t<< \"ControlInfoMap serialization size exceeds wire limits\";\n+\t\treturn -E2BIG;\n+\t}\n+\n+\tsize_t totalSize;\n+\tif (!safeAddSizeT(sizeof(struct ipa_controls_header), entriesSize,\n+\t\t\t &totalSize) ||\n+\t !safeAddSizeT(totalSize, valuesSize, &totalSize)) {\n+\t\tLOG(Serializer, Error)\n+\t\t\t<< \"ControlInfoMap packet size overflows\";\n+\t\treturn -E2BIG;\n+\t}\n+\n+\tsize_t dataOffset;\n+\tif (!safeAddSizeT(sizeof(struct ipa_controls_header), entriesSize,\n+\t\t\t &dataOffset)) {\n+\t\tLOG(Serializer, Error)\n+\t\t\t<< \"ControlInfoMap data offset overflows\";\n+\t\treturn -E2BIG;\n+\t}\n+\tif (!fitsU32(totalSize) || !fitsU32(dataOffset)) {\n+\t\tLOG(Serializer, Error)\n+\t\t\t<< \"ControlInfoMap packet header exceeds wire limits\";\n+\t\treturn -E2BIG;\n \t}\n \n \t/* Prepare the packet header. */\n \tstruct ipa_controls_header hdr = {};\n \thdr.version = IPA_CONTROLS_FORMAT_VERSION;\n \thdr.handle = serial_;\n-\thdr.entries = infoMap.size();\n-\thdr.size = sizeof(hdr) + entriesSize + valuesSize;\n-\thdr.data_offset = sizeof(hdr) + entriesSize;\n+\thdr.entries = static_cast<uint32_t>(infoMap.size());\n+\thdr.size = static_cast<uint32_t>(totalSize);\n+\thdr.data_offset = static_cast<uint32_t>(dataOffset);\n \thdr.id_map_type = idMapType;\n \n \tbuffer.write(&hdr);\n@@ -384,18 +505,62 @@ int ControlSerializer::serialize(const ControlList &list,\n \telse\n \t\tidMapType = IPA_CONTROL_ID_MAP_V4L2;\n \n-\tsize_t entriesSize = list.size() * sizeof(struct ipa_control_list_entry);\n+\tsize_t entriesSize;\n+\tif (!safeMulSizeT(list.size(), sizeof(struct ipa_control_list_entry),\n+\t\t\t &entriesSize)) {\n+\t\tLOG(Serializer, Error)\n+\t\t\t<< \"ControlList entries size overflows\";\n+\t\treturn -E2BIG;\n+\t}\n+\n \tsize_t valuesSize = 0;\n-\tfor (const auto &ctrl : list)\n-\t\tvaluesSize += binarySize(ctrl.second);\n+\tfor (const auto &ctrl : list) {\n+\t\tsize_t nextValuesSize;\n+\t\tif (!safeAddSizeT(valuesSize, binarySize(ctrl.second),\n+\t\t\t\t &nextValuesSize)) {\n+\t\t\tLOG(Serializer, Error)\n+\t\t\t\t<< \"ControlList values size overflows\";\n+\t\t\treturn -E2BIG;\n+\t\t}\n+\t\tvaluesSize = nextValuesSize;\n+\t}\n+\n+\tif (!fitsU32(list.size()) || !fitsU32(entriesSize) ||\n+\t !fitsU32(valuesSize)) {\n+\t\tLOG(Serializer, Error)\n+\t\t\t<< \"ControlList serialization size exceeds wire limits\";\n+\t\treturn -E2BIG;\n+\t}\n+\n+\tsize_t totalSize;\n+\tif (!safeAddSizeT(sizeof(struct ipa_controls_header), entriesSize,\n+\t\t\t &totalSize) ||\n+\t !safeAddSizeT(totalSize, valuesSize, &totalSize)) {\n+\t\tLOG(Serializer, Error)\n+\t\t\t<< \"ControlList packet size overflows\";\n+\t\treturn -E2BIG;\n+\t}\n+\n+\tsize_t dataOffset;\n+\tif (!safeAddSizeT(sizeof(struct ipa_controls_header), entriesSize,\n+\t\t\t &dataOffset)) {\n+\t\tLOG(Serializer, Error)\n+\t\t\t<< \"ControlList data offset overflows\";\n+\t\treturn -E2BIG;\n+\t}\n+\tif (!fitsU32(totalSize) || !fitsU32(dataOffset)) {\n+\t\tLOG(Serializer, Error)\n+\t\t\t<< \"ControlList packet header exceeds wire limits\";\n+\t\treturn -E2BIG;\n+\t}\n \n \t/* Prepare the packet header. */\n \tstruct ipa_controls_header hdr = {};\n \thdr.version = IPA_CONTROLS_FORMAT_VERSION;\n \thdr.handle = infoMapHandle;\n-\thdr.entries = list.size();\n-\thdr.size = sizeof(hdr) + entriesSize + valuesSize;\n-\thdr.data_offset = sizeof(hdr) + entriesSize;\n+\thdr.entries = static_cast<uint32_t>(list.size());\n+\thdr.size = static_cast<uint32_t>(totalSize);\n+\thdr.data_offset = static_cast<uint32_t>(dataOffset);\n \thdr.id_map_type = idMapType;\n \n \tbuffer.write(&hdr);\n@@ -578,6 +743,13 @@ ControlInfoMap ControlSerializer::deserialize<ControlInfoMap>(ByteStreamBuffer &\n \n \t\t/* If we're using a local id map, populate it with the restored name. */\n \t\tif (localIdMap) {\n+\t\t\tif (!isValidDirection(entry->direction)) {\n+\t\t\t\tLOG(Serializer, Error)\n+\t\t\t\t\t<< \"Control direction is invalid: \"\n+\t\t\t\t\t<< static_cast<unsigned int>(entry->direction);\n+\t\t\t\treturn {};\n+\t\t\t}\n+\n \t\t\tstd::string ctrlName(reinterpret_cast<const char *>(nameData),\n \t\t\t\t\t entry->name_len);\n \ndiff --git a/test/serialization/control_serialization.cpp b/test/serialization/control_serialization.cpp\nindex b1638db9..0e15988e 100644\n--- a/test/serialization/control_serialization.cpp\n+++ b/test/serialization/control_serialization.cpp\n@@ -6,6 +6,7 @@\n */\n \n #include <iostream>\n+#include <string.h>\n \n #include <libcamera/camera.h>\n #include <libcamera/control_ids.h>\n@@ -224,11 +225,13 @@ protected:\n \n \t\t/* Reject malformed packets with over-sized names. */\n \t\tvector<uint8_t> badNameLenData = infoData;\n-\t\tauto *badNameLenHeader =\n-\t\t\treinterpret_cast<ipa_controls_header *>(badNameLenData.data());\n-\t\tauto *badNameLenEntry = reinterpret_cast<ipa_control_info_entry *>(\n-\t\t\tbadNameLenData.data() + sizeof(*badNameLenHeader));\n-\t\tbadNameLenEntry->name_len = 2048;\n+\t\tipa_control_info_entry badNameLenEntry;\n+\t\tstd::memcpy(&badNameLenEntry,\n+\t\t\t badNameLenData.data() + sizeof(ipa_controls_header),\n+\t\t\t sizeof(badNameLenEntry));\n+\t\tbadNameLenEntry.name_len = 2048;\n+\t\tstd::memcpy(badNameLenData.data() + sizeof(ipa_controls_header),\n+\t\t\t &badNameLenEntry, sizeof(badNameLenEntry));\n \n \t\tControlSerializer badNameLenDeserializer(ControlSerializer::Role::Worker);\n \t\tbuffer = ByteStreamBuffer(const_cast<const uint8_t *>(badNameLenData.data()),\n@@ -240,7 +243,30 @@ protected:\n \n \t\t/* Reject malformed packets with non-null-terminated names. */\n \t\tvector<uint8_t> badTermData = infoData;\n-\t\tbadTermData.back() = 'X';\n+\t\tipa_controls_header badTermHeader;\n+\t\tipa_control_info_entry badTermEntry;\n+\t\tstd::memcpy(&badTermHeader, badTermData.data(), sizeof(badTermHeader));\n+\t\tstd::memcpy(&badTermEntry,\n+\t\t\t badTermData.data() + sizeof(ipa_controls_header),\n+\t\t\t sizeof(badTermEntry));\n+\n+\t\tif (badTermEntry.id != kV4L2TestControlId ||\n+\t\t badTermEntry.type != ControlTypeInteger32 ||\n+\t\t badTermEntry.def.type != ControlTypeInteger32 ||\n+\t\t badTermEntry.def.is_array || badTermEntry.def.count != 1 ||\n+\t\t badTermEntry.name_len != kV4L2ControlName.size()) {\n+\t\t\tcerr << \"Malformed test packet layout for bad terminator test\" << endl;\n+\t\t\treturn TestFail;\n+\t\t}\n+\n+\t\tsize_t nameStart = badTermHeader.data_offset + badTermEntry.def.offset +\n+\t\t\t\t sizeof(int32_t);\n+\t\tsize_t termOffset = nameStart + badTermEntry.name_len;\n+\t\tif (termOffset >= badTermData.size()) {\n+\t\t\tcerr << \"Malformed test packet while preparing bad terminator\" << endl;\n+\t\t\treturn TestFail;\n+\t\t}\n+\t\tbadTermData[termOffset] = 'X';\n \n \t\tControlSerializer badTermDeserializer(ControlSerializer::Role::Worker);\n \t\tbuffer = ByteStreamBuffer(const_cast<const uint8_t *>(badTermData.data()),\n@@ -278,6 +304,45 @@ protected:\n \t\t\treturn TestFail;\n \t\t}\n \n+\t\t/* Accept names at the configured length limit. */\n+\t\tvector<unique_ptr<ControlId>> maxNameControlIds;\n+\t\tControlIdMap maxNameIdMap;\n+\t\tstring maxName(1024, 'm');\n+\n+\t\tmaxNameControlIds.emplace_back(std::make_unique<ControlId>(\n+\t\t\t0x009a2003, maxName, \"v4l2\", ControlTypeInteger32,\n+\t\t\tControlId::Direction::In));\n+\t\tmaxNameIdMap.emplace(0x009a2003, maxNameControlIds.back().get());\n+\n+\t\tControlInfoMap::Map maxNameInfo;\n+\t\tmaxNameInfo.emplace(maxNameControlIds.back().get(),\n+\t\t\t\t ControlInfo(ControlValue(int32_t{ 0 }),\n+\t\t\t\t\t\tControlValue(int32_t{ 255 }),\n+\t\t\t\t\t\tControlValue(int32_t{ 16 })));\n+\t\tControlSerializer maxNameSerializer(ControlSerializer::Role::Proxy);\n+\t\tControlSerializer maxNameDeserializer(ControlSerializer::Role::Worker);\n+\n+\t\tsize = maxNameSerializer.binarySize(maxNameInfoMap);\n+\t\tinfoData.resize(size);\n+\t\tbuffer = ByteStreamBuffer(infoData.data(), infoData.size());\n+\n+\t\tret = maxNameSerializer.serialize(maxNameInfoMap, buffer);\n+\t\tif (ret < 0 || buffer.overflow()) {\n+\t\t\tcerr << \"Max-length control name should serialize successfully\" << endl;\n+\t\t\treturn TestFail;\n+\t\t}\n+\n+\t\tbuffer = ByteStreamBuffer(const_cast<const uint8_t *>(infoData.data()),\n+\t\t\t\t\t infoData.size());\n+\t\tControlInfoMap maxNameInfoMapDes =\n+\t\t\tmaxNameDeserializer.deserialize<ControlInfoMap>(buffer);\n+\t\tauto maxNameIdIt = maxNameInfoMapDes.idmap().find(0x009a2003);\n+\t\tif (maxNameIdIt == maxNameInfoMapDes.idmap().end() ||\n+\t\t maxNameIdIt->second->name() != maxName) {\n+\t\t\tcerr << \"Max-length control name round-trip failed\" << endl;\n+\t\t\treturn TestFail;\n+\t\t}\n+\n \t\treturn TestPass;\n \t}\n };\n", "prefixes": [ "2/2" ] }