[{"id":5251,"web_url":"https://patchwork.libcamera.org/comment/5251/","msgid":"<20200617153740.i3w5qdupdh7wphfa@uno.localdomain>","date":"2020-06-17T15:37:40","subject":"Re: [libcamera-devel] [PATCH 14/15] v4l2: v4l2_camera_proxy: Check\n\targ->index bounds for querybuf, qbuf, dqbuf","submitter":{"id":3,"url":"https://patchwork.libcamera.org/api/people/3/","name":"Jacopo Mondi","email":"jacopo@jmondi.org"},"content":"Hi Paul,\n\nOn Tue, Jun 16, 2020 at 10:12:43PM +0900, Paul Elder wrote:\n> There were no bounds checks for the index argument for VIDIOC_QUERYBUF,\n> VIDIOC_QBUF, and VIDIOC_DQBUF. Add them.\n>\n\nSeems reasonable!\nReviewed-by: Jacopo Mondi \n\nThanks\n j\n\n> Signed-off-by: Paul Elder \n> ---\n> src/v4l2/v4l2_camera_proxy.cpp | 9 +++++++++\n> 1 file changed, 9 insertions(+)\n>\n> diff --git a/src/v4l2/v4l2_camera_proxy.cpp b/src/v4l2/v4l2_camera_proxy.cpp\n> index 81f9282..e4d534a 100644\n> --- a/src/v4l2/v4l2_camera_proxy.cpp\n> +++ b/src/v4l2/v4l2_camera_proxy.cpp\n> @@ -588,6 +588,9 @@ int V4L2CameraProxy::vidioc_querybuf(int fd, struct v4l2_buffer *arg)\n> \tif (arg == nullptr)\n> \t\treturn -EFAULT;\n>\n> +\tif (arg->index >= bufferCount_)\n> +\t\treturn -EINVAL;\n> +\n> \tint ret = lock(fd);\n> \tif (ret < 0)\n> \t\treturn ret;\n> @@ -610,6 +613,9 @@ int V4L2CameraProxy::vidioc_qbuf(int fd, struct v4l2_buffer *arg)\n> \tif (arg == nullptr)\n> \t\treturn -EFAULT;\n>\n> +\tif (arg->index >= bufferCount_)\n> +\t\treturn -EINVAL;\n> +\n> \tint ret = lock(fd);\n> \tif (ret < 0)\n> \t\treturn ret;\n> @@ -639,6 +645,9 @@ int V4L2CameraProxy::vidioc_dqbuf(int fd, struct v4l2_buffer *arg)\n> \tif (!streaming_)\n> \t\treturn -EINVAL;\n>\n> +\tif (arg->index >= bufferCount_)\n> +\t\treturn -EINVAL;\n> +\n> \tint ret = lock(fd);\n> \tif (ret < 0)\n> \t\treturn ret;\n> --\n> 2.27.0\n>\n> _______________________________________________\n> libcamera-devel mailing list\n> libcamera-devel@lists.libcamera.org\n> https://lists.libcamera.org/listinfo/libcamera-devel","headers":{"Return-Path":"","Received":["from relay12.mail.gandi.net (relay12.mail.gandi.net\n\t[217.70.178.232])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 8C593603BF\n\tfor ;\n\tWed, 17 Jun 2020 17:34:15 +0200 (CEST)","from uno.localdomain (93-34-118-233.ip49.fastwebnet.it\n\t[93.34.118.233]) (Authenticated sender: jacopo@jmondi.org)\n\tby relay12.mail.gandi.net (Postfix) with ESMTPSA id 24E4A200011;\n\tWed, 17 Jun 2020 15:34:14 +0000 (UTC)"],"Date":"Wed, 17 Jun 2020 17:37:40 +0200","From":"Jacopo Mondi ","To":"Paul Elder ","Cc":"libcamera-devel@lists.libcamera.org","Message-ID":"<20200617153740.i3w5qdupdh7wphfa@uno.localdomain>","References":"<20200616131244.70308-1-paul.elder@ideasonboard.com>\n\t<20200616131244.70308-15-paul.elder@ideasonboard.com>","MIME-Version":"1.0","Content-Type":"text/plain; charset=utf-8","Content-Disposition":"inline","In-Reply-To":"<20200616131244.70308-15-paul.elder@ideasonboard.com>","Subject":"Re: [libcamera-devel] [PATCH 14/15] v4l2: v4l2_camera_proxy: Check\n\targ->index bounds for querybuf, qbuf, dqbuf","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","X-List-Received-Date":"Wed, 17 Jun 2020 15:34:15 -0000"}},{"id":5257,"web_url":"https://patchwork.libcamera.org/comment/5257/","msgid":"<20200617155605.GL5838@pendragon.ideasonboard.com>","date":"2020-06-17T15:56:05","subject":"Re: [libcamera-devel] [PATCH 14/15] v4l2: v4l2_camera_proxy: Check\n\targ->index bounds for querybuf, qbuf, dqbuf","submitter":{"id":2,"url":"https://patchwork.libcamera.org/api/people/2/","name":"Laurent Pinchart","email":"laurent.pinchart@ideasonboard.com"},"content":"On Wed, Jun 17, 2020 at 05:37:40PM +0200, Jacopo Mondi wrote:\n> On Tue, Jun 16, 2020 at 10:12:43PM +0900, Paul Elder wrote:\n> > There were no bounds checks for the index argument for VIDIOC_QUERYBUF,\n> > VIDIOC_QBUF, and VIDIOC_DQBUF. Add them.\n> \n> Seems reasonable!\n> Reviewed-by: Jacopo Mondi \n\nLikewise,\n\nReviewed-by: Laurent Pinchart \n\n> > Signed-off-by: Paul Elder \n> > ---\n> > src/v4l2/v4l2_camera_proxy.cpp | 9 +++++++++\n> > 1 file changed, 9 insertions(+)\n> >\n> > diff --git a/src/v4l2/v4l2_camera_proxy.cpp b/src/v4l2/v4l2_camera_proxy.cpp\n> > index 81f9282..e4d534a 100644\n> > --- a/src/v4l2/v4l2_camera_proxy.cpp\n> > +++ b/src/v4l2/v4l2_camera_proxy.cpp\n> > @@ -588,6 +588,9 @@ int V4L2CameraProxy::vidioc_querybuf(int fd, struct v4l2_buffer *arg)\n> > \tif (arg == nullptr)\n> > \t\treturn -EFAULT;\n> >\n> > +\tif (arg->index >= bufferCount_)\n> > +\t\treturn -EINVAL;\n> > +\n> > \tint ret = lock(fd);\n> > \tif (ret < 0)\n> > \t\treturn ret;\n> > @@ -610,6 +613,9 @@ int V4L2CameraProxy::vidioc_qbuf(int fd, struct v4l2_buffer *arg)\n> > \tif (arg == nullptr)\n> > \t\treturn -EFAULT;\n> >\n> > +\tif (arg->index >= bufferCount_)\n> > +\t\treturn -EINVAL;\n> > +\n> > \tint ret = lock(fd);\n> > \tif (ret < 0)\n> > \t\treturn ret;\n> > @@ -639,6 +645,9 @@ int V4L2CameraProxy::vidioc_dqbuf(int fd, struct v4l2_buffer *arg)\n> > \tif (!streaming_)\n> > \t\treturn -EINVAL;\n> >\n> > +\tif (arg->index >= bufferCount_)\n> > +\t\treturn -EINVAL;\n> > +\n> > \tint ret = lock(fd);\n> > \tif (ret < 0)\n> > \t\treturn ret;","headers":{"Return-Path":"","Received":["from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[IPv6:2001:4b98:dc2:55:216:3eff:fef7:d647])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id D5F0A603BF\n\tfor ;\n\tWed, 17 Jun 2020 17:56:28 +0200 (CEST)","from pendragon.ideasonboard.com (81-175-216-236.bb.dnainternet.fi\n\t[81.175.216.236])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id 48E8DF9;\n\tWed, 17 Jun 2020 17:56:28 +0200 (CEST)"],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key; \n\tunprotected) header.d=ideasonboard.com\n\theader.i=@ideasonboard.com\n\theader.b=\"J6q0dqR7\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1592409388;\n\tbh=3fBV34JwpISeMDiOvXLakOeynO2egcGpSfLAkvQdwig=;\n\th=Date:From:To:Cc:Subject:References:In-Reply-To:From;\n\tb=J6q0dqR7TuvOforhMh42CkPr0GfsceB7q2tqBJmuScMhFtfrzytaN9PSBlrNJVzIs\n\t5DX31is36I3l1MGXTO7Du3ze3X0hRK1vxdsBvjOyvGJtyyiRLNvRaFwdVWG1NYa+wP\n\tt9+ZTcUyzBww85c/NmaKAFqQG9AdRcm2rrwhkgh0=","Date":"Wed, 17 Jun 2020 18:56:05 +0300","From":"Laurent Pinchart ","To":"Jacopo Mondi ","Cc":"Paul Elder ,\n\tlibcamera-devel@lists.libcamera.org","Message-ID":"<20200617155605.GL5838@pendragon.ideasonboard.com>","References":"<20200616131244.70308-1-paul.elder@ideasonboard.com>\n\t<20200616131244.70308-15-paul.elder@ideasonboard.com>\n\t<20200617153740.i3w5qdupdh7wphfa@uno.localdomain>","MIME-Version":"1.0","Content-Type":"text/plain; charset=utf-8","Content-Disposition":"inline","In-Reply-To":"<20200617153740.i3w5qdupdh7wphfa@uno.localdomain>","Subject":"Re: [libcamera-devel] [PATCH 14/15] v4l2: v4l2_camera_proxy: Check\n\targ->index bounds for querybuf, qbuf, dqbuf","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","X-List-Received-Date":"Wed, 17 Jun 2020 15:56:29 -0000"}}]