From patchwork Wed Oct 21 02:47:43 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Laurent Pinchart X-Patchwork-Id: 10155 Return-Path: X-Original-To: parsemail@patchwork.libcamera.org Delivered-To: parsemail@patchwork.libcamera.org Received: from lancelot.ideasonboard.com (lancelot.ideasonboard.com [92.243.16.209]) by patchwork.libcamera.org (Postfix) with ESMTPS id C98CEBDB13 for ; Wed, 21 Oct 2020 02:48:36 +0000 (UTC) Received: from lancelot.ideasonboard.com (localhost [IPv6:::1]) by lancelot.ideasonboard.com (Postfix) with ESMTP id 5310661DA6; Wed, 21 Oct 2020 04:48:36 +0200 (CEST) Authentication-Results: lancelot.ideasonboard.com; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=ideasonboard.com header.i=@ideasonboard.com header.b="JL0DpJRn"; dkim-atps=neutral Received: from perceval.ideasonboard.com (perceval.ideasonboard.com [213.167.242.64]) by lancelot.ideasonboard.com (Postfix) with ESMTPS id 1EB1760350 for ; Wed, 21 Oct 2020 04:48:35 +0200 (CEST) Received: from pendragon.lan (62-78-145-57.bb.dnainternet.fi [62.78.145.57]) by perceval.ideasonboard.com (Postfix) with ESMTPSA id A2C6C92 for ; Wed, 21 Oct 2020 04:48:34 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com; s=mail; t=1603248514; bh=bZbgIcwVG2Enir7oSzr6vgHMDyO0BR75+hlNr+iWWv4=; h=From:To:Subject:Date:From; b=JL0DpJRnyHMZ6t/MZezMh7K1pzlP5Fy1DHMsppliQ3ZNDfEeGQfrtQCzEM/4k/14y Fi8RMuBp8574iYKnoJQG5E2bZzXpkcrYTNBsGw6oEpWkntQiWfmdmtZ6+x204tFmXF dTAQFIFsH8X5vmduEu193r66lMkux5sptN8Epedc= From: Laurent Pinchart To: libcamera-devel@lists.libcamera.org Date: Wed, 21 Oct 2020 05:47:43 +0300 Message-Id: <20201021024744.19047-1-laurent.pinchart@ideasonboard.com> X-Mailer: git-send-email 2.27.0 MIME-Version: 1.0 Subject: [libcamera-devel] [PATCH 1/2] libcamera: v4l2_videodevice: Check plane count when setting format X-BeenThere: libcamera-devel@lists.libcamera.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libcamera-devel-bounces@lists.libcamera.org Sender: "libcamera-devel" When setting (or trying) a format with a multiplanar device, the V4L2VideoDevice::trySetFormatMeta() function iterates over all planes available in the V4L2DeviceFormat structure. The caller is responsible for setting the plane count, and failure to do so properly may result in memory corruption. This can lead to a crash way after the function returns, making the problem difficult to debug. As the issue is caused by a bug in the caller, use an assertion to catch it. Signed-off-by: Laurent Pinchart Reviewed-by: Kieran Bingham Reviewed-by: Niklas Söderlund --- src/libcamera/v4l2_videodevice.cpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/libcamera/v4l2_videodevice.cpp b/src/libcamera/v4l2_videodevice.cpp index 16162e1edba3..3ba9e5ba134a 100644 --- a/src/libcamera/v4l2_videodevice.cpp +++ b/src/libcamera/v4l2_videodevice.cpp @@ -861,6 +861,8 @@ int V4L2VideoDevice::trySetFormatMultiplane(V4L2DeviceFormat *format, bool set) pix->num_planes = format->planesCount; pix->field = V4L2_FIELD_NONE; + ASSERT(pix->num_planes <= ARRAY_SIZE(pix->plane_fmt)); + for (unsigned int i = 0; i < pix->num_planes; ++i) { pix->plane_fmt[i].bytesperline = format->planes[i].bpl; pix->plane_fmt[i].sizeimage = format->planes[i].size;