From patchwork Fri Apr 16 13:43:47 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hirokazu Honda X-Patchwork-Id: 11967 Return-Path: X-Original-To: parsemail@patchwork.libcamera.org Delivered-To: parsemail@patchwork.libcamera.org Received: from lancelot.ideasonboard.com (lancelot.ideasonboard.com [92.243.16.209]) by patchwork.libcamera.org (Postfix) with ESMTPS id 906E4BD236 for ; Fri, 16 Apr 2021 13:43:58 +0000 (UTC) Received: from lancelot.ideasonboard.com (localhost [IPv6:::1]) by lancelot.ideasonboard.com (Postfix) with ESMTP id 532B86880A; Fri, 16 Apr 2021 15:43:58 +0200 (CEST) Authentication-Results: lancelot.ideasonboard.com; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=chromium.org header.i=@chromium.org header.b="m9lXHJM3"; dkim-atps=neutral Received: from mail-pg1-x535.google.com (mail-pg1-x535.google.com [IPv6:2607:f8b0:4864:20::535]) by lancelot.ideasonboard.com (Postfix) with ESMTPS id 7CFB16880A for ; Fri, 16 Apr 2021 15:43:56 +0200 (CEST) Received: by mail-pg1-x535.google.com with SMTP id 31so3775603pgn.13 for ; Fri, 16 Apr 2021 06:43:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=CZGaMpLSGBqWIYeKYD9P07cZ3KUZ0WaCTtrOPrRZLlA=; b=m9lXHJM3ujuubLPiJ/lnfqOQOeCNo/iv+qNnEte1kyldRtDxsV4wSvwaWn4pYne7Px L2spl1apYtFQh4EmhVol7w7FTvfqA//ovKdUIlFiiaBDz74lrqvfoxkolqweeGy7yP3D zoYytVM9b4mgMGB3dUR+4uBV72lFnhFQpXxPo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=CZGaMpLSGBqWIYeKYD9P07cZ3KUZ0WaCTtrOPrRZLlA=; b=UgSTBpC4d9qASvtCeGUD2ob7jMsQD+RyK9xAm94kkH90bIA3/6lKxBV4iONvrlk8Bu LdAsh/9HKPbzpxRb/mPP3duCKNI/ScHnOLiO8GIhqvSEjEi2maXQ4Hs3Eu5Gu6N2Xnsl bzprjcXyDVffsqxw1GmrSkbO89b937iANWQHcEV1T3bSdlcDihcOSzhrY7WUzSAak2DB I8MSaJjOSksHtbRw0aSv12sBijAMfZXzAgQTd5ytSgUfQQ06N3Smk8vM9gVc9x/6UI9s Sfuv5vhQGqn4bJSvXGp7TY34PmNxKo4oN3vSbn1iqlgH58sdezBcocbfxS0HRLXO5Uq6 8D7g== X-Gm-Message-State: AOAM533uDk73eKnld5jEzO3EAkSj5Ul5rL4o4fSofhRXewoFu9UciYFu +ovW8/n2v2nwKLTHXtHO1Em6UPx3pOaTIQ== X-Google-Smtp-Source: ABdhPJwihx17Os00JuRn/I9XBWDMMLSnwqtYYW4WB3XE0Dzs3LDyJnswXfSJFtepOnd2bvgDpB83dA== X-Received: by 2002:a63:36ce:: with SMTP id d197mr7989925pga.237.1618580634656; Fri, 16 Apr 2021 06:43:54 -0700 (PDT) Received: from hiroh2.tok.corp.google.com ([2401:fa00:8f:2:8518:74e8:412c:f22f]) by smtp.gmail.com with ESMTPSA id ms9sm6175606pjb.32.2021.04.16.06.43.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Apr 2021 06:43:54 -0700 (PDT) From: Hirokazu Honda To: libcamera-devel@lists.libcamera.org Date: Fri, 16 Apr 2021 22:43:47 +0900 Message-Id: <20210416134347.2881373-2-hiroh@chromium.org> X-Mailer: git-send-email 2.31.1.368.gbe11c130af-goog In-Reply-To: <20210416134347.2881373-1-hiroh@chromium.org> References: <20210416134347.2881373-1-hiroh@chromium.org> MIME-Version: 1.0 Subject: [libcamera-devel] [PATCH v4 2/2] android: CameraDevice: Validate buffer_handle by CameraBuffer::isValidBuffer() X-BeenThere: libcamera-devel@lists.libcamera.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libcamera-devel-bounces@lists.libcamera.org Sender: "libcamera-devel" This adds a validation to buffer_handle provided in CameraDevice::processCaptureRequest() by using CameraBuffer::isValidBuffer(). Signed-off-by: Hirokazu Honda Reviewed-by: Jacopo Mondi --- src/android/camera_device.cpp | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/android/camera_device.cpp b/src/android/camera_device.cpp index 89044efa..7247c12c 100644 --- a/src/android/camera_device.cpp +++ b/src/android/camera_device.cpp @@ -293,6 +293,11 @@ bool isValidRequest(camera3_capture_request_t *camera3Request) << ") in buffer " << i; return false; } + + if (!CameraBuffer::isValidBuffer(handle)) { + LOG(HAL, Error) << "Buffer " << i << " is invalid"; + return false; + } } return true;