[libcamera-devel,v2,2/3] libcamera: v4l2_videodevice: Check plane count when setting format
diff mbox series

Message ID 20201104074841.21676-3-laurent.pinchart@ideasonboard.com
State Accepted
Commit e9463449049c78b6b1c61410082a5339338b2e81
Headers show
Series
  • libcamera: Fix uninitialized use of V4L2DeviceFormat members
Related show

Commit Message

Laurent Pinchart Nov. 4, 2020, 7:48 a.m. UTC 
When setting (or trying) a format with a multiplanar device, the
V4L2VideoDevice::trySetFormatMeta() function iterates over all planes
available in the V4L2DeviceFormat structure. The caller is responsible
for setting the plane count, and failure to do so properly may result in
memory corruption. This can lead to a crash way after the function
returns, making the problem difficult to debug.

As the issue is caused by a bug in the caller, use an assertion to catch
it.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Niklas Söderlund <niklas.soderlund@ragnatech.se>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
---
 src/libcamera/v4l2_videodevice.cpp | 2 ++
 1 file changed, 2 insertions(+)

Patch
diff mbox series 

diff --git a/src/libcamera/v4l2_videodevice.cpp b/src/libcamera/v4l2_videodevice.cpp
index d07c3530eea5..ac3c8c7dd97a 100644
--- a/src/libcamera/v4l2_videodevice.cpp
+++ b/src/libcamera/v4l2_videodevice.cpp
@@ -870,6 +870,8 @@  int V4L2VideoDevice::trySetFormatMultiplane(V4L2DeviceFormat *format, bool set)
 	pix->num_planes = format->planesCount;
 	pix->field = V4L2_FIELD_NONE;
 
+	ASSERT(pix->num_planes <= ARRAY_SIZE(pix->plane_fmt));
+
 	for (unsigned int i = 0; i < pix->num_planes; ++i) {
 		pix->plane_fmt[i].bytesperline = format->planes[i].bpl;
 		pix->plane_fmt[i].sizeimage = format->planes[i].size;