From patchwork Sat Jul 25 13:14:07 2026
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-Patchwork-Submitter: Magdum <magdum.foss@gmail.com>
X-Patchwork-Id: 27507
Return-Path: <libcamera-devel-bounces@lists.libcamera.org>
X-Original-To: parsemail@patchwork.libcamera.org
Delivered-To: parsemail@patchwork.libcamera.org
Received: from lancelot.ideasonboard.com (lancelot.ideasonboard.com
	[92.243.16.209])
	by patchwork.libcamera.org (Postfix) with ESMTPS id 03855BE080
	for <parsemail@patchwork.libcamera.org>;
	Sat, 25 Jul 2026 13:19:40 +0000 (UTC)
Received: from lancelot.ideasonboard.com (localhost [IPv6:::1])
	by lancelot.ideasonboard.com (Postfix) with ESMTP id 20F6167F4B;
	Sat, 25 Jul 2026 15:19:40 +0200 (CEST)
Authentication-Results: lancelot.ideasonboard.com; dkim=pass (2048-bit key;
	unprotected) header.d=gmail.com header.i=@gmail.com
	header.b="eGCRCX6y"; dkim-atps=neutral
Received: from mail-wm1-x331.google.com (mail-wm1-x331.google.com
	[IPv6:2a00:1450:4864:20::331])
	by lancelot.ideasonboard.com (Postfix) with ESMTPS id B95B767E5C
	for <libcamera-devel@lists.libcamera.org>;
	Sat, 25 Jul 2026 15:19:38 +0200 (CEST)
Received: by mail-wm1-x331.google.com with SMTP id
	5b1f17b1804b1-495590ba856so11711025e9.2
	for <libcamera-devel@lists.libcamera.org>;
	Sat, 25 Jul 2026 06:19:38 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=gmail.com; s=20251104; t=1784985578; x=1785590378;
	darn=lists.libcamera.org;
	h=content-transfer-encoding:content-type:mime-version:references
	:in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject
	:date:message-id:reply-to:content-type;
	bh=+ZUxNNJ5Yj7xbJ5jiL5/jDB7p7bOZRI06MAE8OfhJM4=;
	b=eGCRCX6yKpk9OrtH/3P1BchRHThIBeBbZpjeMQNKmLSW/0lAKSG1YX7qukL36vX8F8
	vFYYcjTfUJlYRJH769qmjFfPFomQ0J6HSrwvMUfcXQmHYz7LD/be4yI4LwEs7wnKyjch
	6Quny3a4RWEQiRBh8OMosQCzoIY9/C2+2TddPB0Wzd/Buzxv5ksjltwtXkhfgHVDNNc0
	WpgbdCczKG0CAPdamLk28+D/p6OH5ELJnneu3MZHzq6/A2l9M5jCAxKGs0LPXwYRFwo+
	gdd/tVYgi+zJsrKhSYdQ7J6tLN92k8fLbStoOtk2wiDeqHBaIHzpqTBaop1Ga9so0U/S
	Fi3w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=1e100.net; s=20251104; t=1784985578; x=1785590378;
	h=content-transfer-encoding:content-type:mime-version:references
	:in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg
	:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to
	:content-type;
	bh=+ZUxNNJ5Yj7xbJ5jiL5/jDB7p7bOZRI06MAE8OfhJM4=;
	b=sVnTPl16Lx0RtIEefPDCM5+zkXAhxzy6d2q3Y72NwMNNOLtod0G+/GZUPN6pb3I5KJ
	aInE0T5tO0ZQ9R40U2GdlMXX8LW1H3i/lFQdG6/IGsbxwFvdLp+eYI2+vzlwo5a8PTcp
	3Sr0IrZkQMhrakA7WgAuSCRPB5cOnOS9J4/KJK1Vjw6s39afZ18vHDeJj3qFoUiZB7Ga
	bmK1bSX4eR9Q/16V0MCs4PSLx0wKsNK3F8hTTRFkCujwDrpW5G05lCSaHVgSojGDAX18
	EhYBFDX1Byjg+qZ40bLQCpAYi2sSXHMynos+CQg/8HHI47A+aE0keRkODdqZqM9RuU3S
	drHg==
X-Gm-Message-State: AOJu0YwA+gQ1N/mA9gcOJbCRPvg2HPKMuuQapuN+tDarRKlJ+ZUDvmBZ
	2P9xYn3OkDOSOxQ5kfwExOs6fP/b2FzoP6uqOPwCtO2MWp+1gr9sV+yppphlHYcHX5Y=
X-Gm-Gg: AR+sD13O1KLc4mZW7MiDAZS0OvmvCYLQWp0VDiErECRvW5YmoA4pcagIVNBxU6IpiCm
	TSLyf4MdTiTjh26y72ZSF5PSftecTV8rjsg37CVVpFLmda0+D72zRcXi0leGiQn93ElCBeVQhFB
	5L5nyfk6MHicYGidh1MiCVV4TgUx/tbCslG3LWw5Cu92GsMkgUaCMJ/npyAjem3ni4rH6BYdjCI
	Y/CDKR6wSP5MXljRZdxjx1uhS+1etQq14K3mqSVJ414/1RbtiUItK732GO5B194qCEgF5Nn1Yuq
	iOsTYNyFy4pebZ3y5ukO+sckEtTaVFphQwNoct2SUsDyhPOY1dYuuKOkaMoPwj+29efGBi1bzQ3
	wuSWu+AYD9df1N5FmksLrZx6G7CY44/3AP3VnmkVdMEfVatH5B7rmmentfTS5OnSd0S+XWQu0BM
	Cfwt8/s6Ox+QrDNkZ/xl+GiMjUc8BCMIoUknHrVlRH5+YM4MapfKeiOKdvg+jzrME=
X-Received: by 2002:a05:600c:3509:b0:495:64c6:84e9 with SMTP id
	5b1f17b1804b1-496b5648f38mr26903575e9.0.1784985577662;
	Sat, 25 Jul 2026 06:19:37 -0700 (PDT)
Received: from magdum-System-Product-Name.vodafone.ultrahub
	([2a02:810d:4b14:4600:4c66:91af:4d7a:df5e])
	by smtp.gmail.com with ESMTPSA id
	5b1f17b1804b1-496b49a6e17sm67431455e9.13.2026.07.25.06.19.36
	(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
	Sat, 25 Jul 2026 06:19:37 -0700 (PDT)
From: Magdum <magdum.foss@gmail.com>
To: libcamera-devel@lists.libcamera.org
Cc: Magdum <magdum.foss@gmail.com>
Subject: [PATCH v2 2/2] libcamera: Harden control serializer size and input
	validation
Date: Sat, 25 Jul 2026 15:14:07 +0200
Message-ID: <20260725131932.13509-1-magdum.foss@gmail.com>
X-Mailer: git-send-email 2.43.0
In-Reply-To: <20260723174644.6580-3-magdum.foss@gmail.com>
References: <20260723174644.6580-3-magdum.foss@gmail.com>
MIME-Version: 1.0
X-BeenThere: libcamera-devel@lists.libcamera.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: <libcamera-devel.lists.libcamera.org>
List-Unsubscribe: <https://lists.libcamera.org/options/libcamera-devel>,
	<mailto:libcamera-devel-request@lists.libcamera.org?subject=unsubscribe>
List-Archive: <https://lists.libcamera.org/pipermail/libcamera-devel/>
List-Post: <mailto:libcamera-devel@lists.libcamera.org>
List-Help: <mailto:libcamera-devel-request@lists.libcamera.org?subject=help>
List-Subscribe: <https://lists.libcamera.org/listinfo/libcamera-devel>,
	<mailto:libcamera-devel-request@lists.libcamera.org?subject=subscribe>
Errors-To: libcamera-devel-bounces@lists.libcamera.org
Sender: "libcamera-devel" <libcamera-devel-bounces@lists.libcamera.org>

Add overflow-safe size computations before writing 32-bit wire
fields, centralize control-name size accounting, and validate
deserialized local control direction values. Strengthen tests
with alignment-safe packet mutation, deterministic malformed
name-offset corruption, and max-length control-name boundary
coverage.

Signed-off-by: Magdum <magdum.foss@gmail.com>
---
<<I feel like this function could go into the previous patch.
Agreed. Moved serializedControlNameSize into the patch that first introduces it.

<<You can adjust this:
<<   if (rhs && lhs > std::numeric_limits<size_t>::max() / rhs)
<<     return false;
<< and drop the previous `if`.
Good simplification — the rhs && guard makes the explicit zero-case branch unnecessary since lhs * 0 = 0 falls through correctly anyway.

<<You can just say `return *out >= lhs;` and drop the `if`.
Done

<< But in any case I am a bit wary of these ad-hoc implementations here. Given that
<<only clang and gcc are supported as compilers, I think it would be preferable to
<<use the overflow checking builtins: https://gcc.gnu.org/onlinedocs/gcc/Integer-Overflow-Builtins.html
<<Specifically `__builtin_{add,mul}_overflow`, possibly hidden inside some trivial
<<wrappers in `utils.h`.
Good call — replaced both ad-hoc implementations with __builtin_add_overflow / __builtin_mul_overflow wrapped as utils::addOverflow / utils::mulOverflow in utils.h, following the pattern of the existing utils helpers.

<<You can use `utils::to_underlying()`.
Done

<<You can just say `case (kDirectionIn | kDirectionOut):` here
Done

<<But you can also simplify the function greatly, e.g.:
<<   constexpr unsigned int valid = utils::to_underlying(ControlId::Direction::In) | utils::to_underlying(ControlId::Direction::Out);
<<   return (direction & valid) && !(direction & ~valid);
Done

========================================================================
CHANGELOG / COMMENTS FROM REPLY.TXT:
========================================================================

========================================================================
 include/libcamera/base/utils.h               |  12 ++
 src/libcamera/control_serializer.cpp         | 196 ++++++++++++++++---
 test/serialization/control_serialization.cpp |  86 ++++++--
 3 files changed, 257 insertions(+), 37 deletions(-)

diff --git a/include/libcamera/base/utils.h b/include/libcamera/base/utils.h
index 9835fd798..d73db428c 100644
--- a/include/libcamera/base/utils.h
+++ b/include/libcamera/base/utils.h
@@ -449,6 +449,18 @@ constexpr details::defopt_t defopt;
 std::ostream &operator<<(std::ostream &os, const Duration &d);
 #endif
 
+template<typename T>
+bool addOverflow(T lhs, T rhs, T *result)
+{
+	return __builtin_add_overflow(lhs, rhs, result);
+}
+
+template<typename T>
+bool mulOverflow(T lhs, T rhs, T *result)
+{
+	return __builtin_mul_overflow(lhs, rhs, result);
+}
+
 } /* namespace utils */
 
 } /* namespace libcamera */
diff --git a/src/libcamera/control_serializer.cpp b/src/libcamera/control_serializer.cpp
index a420d4700..ceafff326 100644
--- a/src/libcamera/control_serializer.cpp
+++ b/src/libcamera/control_serializer.cpp
@@ -8,11 +8,13 @@
 #include "libcamera/internal/control_serializer.h"
 
 #include <algorithm>
+#include <limits>
 #include <memory>
 #include <vector>
 
 #include <libcamera/base/log.h>
 #include <libcamera/base/span.h>
+#include <libcamera/base/utils.h>
 
 #include <libcamera/control_ids.h>
 #include <libcamera/controls.h>
@@ -53,7 +55,31 @@ bool idMapRequiresLocalIds(enum ipa_controls_id_map_type idMapType)
 size_t serializedControlNameSize(const ControlId *id,
 		enum ipa_controls_id_map_type idMapType)
 {
-	return idMapRequiresLocalIds(idMapType) ? id->name().size() + 1 : 1;
+	return idMapRequiresLocalIds(idMapType) ? id->name().size() : 1;
+}
+
+bool fitsU32(size_t value)
+{
+	return value <= std::numeric_limits<uint32_t>::max();
+}
+
+bool safeMulSizeT(size_t lhs, size_t rhs, size_t *out)
+{
+	return !utils::mulOverflow(lhs, rhs, out);
+}
+
+bool safeAddSizeT(size_t lhs, size_t rhs, size_t *out)
+{
+	return !utils::addOverflow(lhs, rhs, out);
+}
+
+bool isValidDirection(uint8_t direction)
+{
+	constexpr unsigned int valid =
+		utils::to_underlying(ControlId::Direction::In) |
+		utils::to_underlying(ControlId::Direction::Out);
+
+	return (direction & valid) && !(direction & ~valid);
 }
 
 } /* namespace */
@@ -190,14 +216,27 @@ size_t ControlSerializer::binarySize(const ControlInfo &info)
  */
 size_t ControlSerializer::binarySize(const ControlInfoMap &infoMap)
 {
-	size_t size = sizeof(struct ipa_controls_header)
-		    + infoMap.size() * sizeof(struct ipa_control_info_entry);
+	size_t entriesSize;
+	if (!safeMulSizeT(infoMap.size(), sizeof(struct ipa_control_info_entry),
+			  &entriesSize))
+		return std::numeric_limits<size_t>::max();
+
+	size_t size;
+	if (!safeAddSizeT(sizeof(struct ipa_controls_header), entriesSize, &size))
+		return std::numeric_limits<size_t>::max();
+
 	enum ipa_controls_id_map_type idMapType = idMapTypeFor(infoMap.idmap());
 
 	for (const auto &ctrl : infoMap) {
-		size += binarySize(ctrl.second);
-
-		size += serializedControlNameSize(ctrl.first, idMapType);
+		size_t nextSize;
+		if (!safeAddSizeT(size, binarySize(ctrl.second), &nextSize))
+			return std::numeric_limits<size_t>::max();
+		size = nextSize;
+
+		size_t nameSize = serializedControlNameSize(ctrl.first, idMapType);
+		if (!safeAddSizeT(size, nameSize, &nextSize))
+			return std::numeric_limits<size_t>::max();
+		size = nextSize;
 	}
 
 	return size;
@@ -214,10 +253,21 @@ size_t ControlSerializer::binarySize(const ControlInfoMap &infoMap)
  */
 size_t ControlSerializer::binarySize(const ControlList &list)
 {
-	size_t size = sizeof(struct ipa_controls_header) + list.size() * sizeof(struct ipa_control_list_entry);
+	size_t entriesSize;
+	if (!safeMulSizeT(list.size(), sizeof(struct ipa_control_list_entry),
+			  &entriesSize))
+		return std::numeric_limits<size_t>::max();
+
+	size_t size;
+	if (!safeAddSizeT(sizeof(struct ipa_controls_header), entriesSize, &size))
+		return std::numeric_limits<size_t>::max();
 
-	for (const auto &ctrl : list)
-		size += binarySize(ctrl.second);
+	for (const auto &ctrl : list) {
+		size_t nextSize;
+		if (!safeAddSizeT(size, binarySize(ctrl.second), &nextSize))
+			return std::numeric_limits<size_t>::max();
+		size = nextSize;
+	}
 
 	return size;
 }
@@ -264,23 +314,70 @@ int ControlSerializer::serialize(const ControlInfoMap &infoMap,
 	enum ipa_controls_id_map_type idMapType = idMapTypeFor(infoMap.idmap());
 
 	/* Compute entries and data required sizes. */
-	size_t entriesSize = infoMap.size()
-			   * sizeof(struct ipa_control_info_entry);
+	size_t entriesSize;
+	if (!safeMulSizeT(infoMap.size(), sizeof(struct ipa_control_info_entry),
+			  &entriesSize)) {
+		LOG(Serializer, Error)
+			<< "ControlInfoMap entries size overflows";
+		return -E2BIG;
+	}
+
 	size_t valuesSize = 0;
 	for (const auto &ctrl : infoMap) {
-		valuesSize += binarySize(ctrl.second);
-		valuesSize += idMapRequiresLocalIds(idMapType)
-				      ? ctrl.first->name().size()
-				      : 0;
+		size_t valueSize = binarySize(ctrl.second);
+		size_t nextValuesSize;
+		if (!safeAddSizeT(valuesSize, valueSize, &nextValuesSize)) {
+			LOG(Serializer, Error)
+				<< "ControlInfoMap values size overflows";
+			return -E2BIG;
+		}
+		valuesSize = nextValuesSize;
+
+		size_t nameSize = serializedControlNameSize(ctrl.first, idMapType);
+		if (!safeAddSizeT(valuesSize, nameSize, &nextValuesSize)) {
+			LOG(Serializer, Error)
+				<< "ControlInfoMap names size overflows";
+			return -E2BIG;
+		}
+		valuesSize = nextValuesSize;
+	}
+
+	if (!fitsU32(infoMap.size()) || !fitsU32(entriesSize) ||
+	    !fitsU32(valuesSize)) {
+		LOG(Serializer, Error)
+			<< "ControlInfoMap serialization size exceeds wire limits";
+		return -E2BIG;
+	}
+
+	size_t totalSize;
+	if (!safeAddSizeT(sizeof(struct ipa_controls_header), entriesSize,
+			  &totalSize) ||
+	    !safeAddSizeT(totalSize, valuesSize, &totalSize)) {
+		LOG(Serializer, Error)
+			<< "ControlInfoMap packet size overflows";
+		return -E2BIG;
+	}
+
+	size_t dataOffset;
+	if (!safeAddSizeT(sizeof(struct ipa_controls_header), entriesSize,
+			  &dataOffset)) {
+		LOG(Serializer, Error)
+			<< "ControlInfoMap data offset overflows";
+		return -E2BIG;
+	}
+	if (!fitsU32(totalSize) || !fitsU32(dataOffset)) {
+		LOG(Serializer, Error)
+			<< "ControlInfoMap packet header exceeds wire limits";
+		return -E2BIG;
 	}
 
 	/* Prepare the packet header. */
 	struct ipa_controls_header hdr = {};
 	hdr.version = IPA_CONTROLS_FORMAT_VERSION;
 	hdr.handle = serial_;
-	hdr.entries = infoMap.size();
-	hdr.size = sizeof(hdr) + entriesSize + valuesSize;
-	hdr.data_offset = sizeof(hdr) + entriesSize;
+	hdr.entries = static_cast<uint32_t>(infoMap.size());
+	hdr.size = static_cast<uint32_t>(totalSize);
+	hdr.data_offset = static_cast<uint32_t>(dataOffset);
 	hdr.id_map_type = idMapType;
 
 	buffer.write(&hdr);
@@ -389,18 +486,62 @@ int ControlSerializer::serialize(const ControlList &list,
 	else
 		idMapType = IPA_CONTROL_ID_MAP_V4L2;
 
-	size_t entriesSize = list.size() * sizeof(struct ipa_control_list_entry);
+	size_t entriesSize;
+	if (!safeMulSizeT(list.size(), sizeof(struct ipa_control_list_entry),
+			  &entriesSize)) {
+		LOG(Serializer, Error)
+			<< "ControlList entries size overflows";
+		return -E2BIG;
+	}
+
 	size_t valuesSize = 0;
-	for (const auto &ctrl : list)
-		valuesSize += binarySize(ctrl.second);
+	for (const auto &ctrl : list) {
+		size_t nextValuesSize;
+		if (!safeAddSizeT(valuesSize, binarySize(ctrl.second),
+				  &nextValuesSize)) {
+			LOG(Serializer, Error)
+				<< "ControlList values size overflows";
+			return -E2BIG;
+		}
+		valuesSize = nextValuesSize;
+	}
+
+	if (!fitsU32(list.size()) || !fitsU32(entriesSize) ||
+	    !fitsU32(valuesSize)) {
+		LOG(Serializer, Error)
+			<< "ControlList serialization size exceeds wire limits";
+		return -E2BIG;
+	}
+
+	size_t totalSize;
+	if (!safeAddSizeT(sizeof(struct ipa_controls_header), entriesSize,
+			  &totalSize) ||
+	    !safeAddSizeT(totalSize, valuesSize, &totalSize)) {
+		LOG(Serializer, Error)
+			<< "ControlList packet size overflows";
+		return -E2BIG;
+	}
+
+	size_t dataOffset;
+	if (!safeAddSizeT(sizeof(struct ipa_controls_header), entriesSize,
+			  &dataOffset)) {
+		LOG(Serializer, Error)
+			<< "ControlList data offset overflows";
+		return -E2BIG;
+	}
+	if (!fitsU32(totalSize) || !fitsU32(dataOffset)) {
+		LOG(Serializer, Error)
+			<< "ControlList packet header exceeds wire limits";
+		return -E2BIG;
+	}
 
 	/* Prepare the packet header. */
 	struct ipa_controls_header hdr = {};
 	hdr.version = IPA_CONTROLS_FORMAT_VERSION;
 	hdr.handle = infoMapHandle;
-	hdr.entries = list.size();
-	hdr.size = sizeof(hdr) + entriesSize + valuesSize;
-	hdr.data_offset = sizeof(hdr) + entriesSize;
+	hdr.entries = static_cast<uint32_t>(list.size());
+	hdr.size = static_cast<uint32_t>(totalSize);
+	hdr.data_offset = static_cast<uint32_t>(dataOffset);
 	hdr.id_map_type = idMapType;
 
 	buffer.write(&hdr);
@@ -586,6 +727,13 @@ ControlInfoMap ControlSerializer::deserialize<ControlInfoMap>(ByteStreamBuffer &
 
 		/* If we're using a local id map, populate it with the restored name. */
 		if (localIdMap) {
+			if (!isValidDirection(entry->direction)) {
+				LOG(Serializer, Error)
+					<< "Control direction is invalid: "
+					<< static_cast<unsigned int>(entry->direction);
+				return {};
+			}
+
 			std::string ctrlName(reinterpret_cast<const char *>(nameData),
 					     entry->name_len);
 
diff --git a/test/serialization/control_serialization.cpp b/test/serialization/control_serialization.cpp
index b1638db9f..1fb8cc8b7 100644
--- a/test/serialization/control_serialization.cpp
+++ b/test/serialization/control_serialization.cpp
@@ -6,6 +6,7 @@
  */
 
 #include <iostream>
+#include <cstring>
 
 #include <libcamera/camera.h>
 #include <libcamera/control_ids.h>
@@ -224,11 +225,13 @@ protected:
 
 		/* Reject malformed packets with over-sized names. */
 		vector<uint8_t> badNameLenData = infoData;
-		auto *badNameLenHeader =
-			reinterpret_cast<ipa_controls_header *>(badNameLenData.data());
-		auto *badNameLenEntry = reinterpret_cast<ipa_control_info_entry *>(
-			badNameLenData.data() + sizeof(*badNameLenHeader));
-		badNameLenEntry->name_len = 2048;
+		ipa_control_info_entry badNameLenEntry;
+		std::memcpy(&badNameLenEntry,
+			    badNameLenData.data() + sizeof(ipa_controls_header),
+			    sizeof(badNameLenEntry));
+		badNameLenEntry.name_len = 2048;
+		std::memcpy(badNameLenData.data() + sizeof(ipa_controls_header),
+			    &badNameLenEntry, sizeof(badNameLenEntry));
 
 		ControlSerializer badNameLenDeserializer(ControlSerializer::Role::Worker);
 		buffer = ByteStreamBuffer(const_cast<const uint8_t *>(badNameLenData.data()),
@@ -238,15 +241,31 @@ protected:
 			return TestFail;
 		}
 
-		/* Reject malformed packets with non-null-terminated names. */
-		vector<uint8_t> badTermData = infoData;
-		badTermData.back() = 'X';
+		/* Reject malformed packets with inconsistent name offsets. */
+		vector<uint8_t> badNameOffsetData = infoData;
+		ipa_control_info_entry badNameOffsetEntry;
+		std::memcpy(&badNameOffsetEntry,
+			    badNameOffsetData.data() + sizeof(ipa_controls_header),
+			    sizeof(badNameOffsetEntry));
+
+		if (badNameOffsetEntry.id != kV4L2TestControlId ||
+		    badNameOffsetEntry.type != ControlTypeInteger32 ||
+		    badNameOffsetEntry.def.type != ControlTypeInteger32 ||
+		    badNameOffsetEntry.def.is_array || badNameOffsetEntry.def.count != 1 ||
+		    badNameOffsetEntry.name_len != kV4L2ControlName.size()) {
+			cerr << "Malformed test packet layout for bad name offset test" << endl;
+			return TestFail;
+		}
+
+		badNameOffsetEntry.name_offset += 1;
+		std::memcpy(badNameOffsetData.data() + sizeof(ipa_controls_header),
+			    &badNameOffsetEntry, sizeof(badNameOffsetEntry));
 
-		ControlSerializer badTermDeserializer(ControlSerializer::Role::Worker);
-		buffer = ByteStreamBuffer(const_cast<const uint8_t *>(badTermData.data()),
-					  badTermData.size());
-		if (!badTermDeserializer.deserialize<ControlInfoMap>(buffer).empty()) {
-			cerr << "Control name without null terminator should be rejected" << endl;
+		ControlSerializer badNameOffsetDeserializer(ControlSerializer::Role::Worker);
+		buffer = ByteStreamBuffer(const_cast<const uint8_t *>(badNameOffsetData.data()),
+					  badNameOffsetData.size());
+		if (!badNameOffsetDeserializer.deserialize<ControlInfoMap>(buffer).empty()) {
+			cerr << "Control with inconsistent name offset should be rejected" << endl;
 			return TestFail;
 		}
 
@@ -278,6 +297,47 @@ protected:
 			return TestFail;
 		}
 
+		/* Accept names at the configured length limit. */
+		vector<unique_ptr<ControlId>> maxNameControlIds;
+		ControlIdMap maxNameIdMap;
+		string maxName(1024, 'm');
+
+		maxNameControlIds.emplace_back(std::make_unique<ControlId>(
+			0x009a2003, maxName, "v4l2", ControlTypeInteger32,
+			ControlId::Direction::In));
+		maxNameIdMap.emplace(0x009a2003, maxNameControlIds.back().get());
+
+		ControlInfoMap::Map maxNameInfo;
+		maxNameInfo.emplace(maxNameControlIds.back().get(),
+				    ControlInfo(ControlValue(int32_t{ 0 }),
+						ControlValue(int32_t{ 255 }),
+						ControlValue(int32_t{ 16 })));
+		ControlInfoMap maxNameInfoMap(std::move(maxNameInfo), maxNameIdMap);
+
+		ControlSerializer maxNameSerializer(ControlSerializer::Role::Proxy);
+		ControlSerializer maxNameDeserializer(ControlSerializer::Role::Worker);
+
+		size = maxNameSerializer.binarySize(maxNameInfoMap);
+		infoData.resize(size);
+		buffer = ByteStreamBuffer(infoData.data(), infoData.size());
+
+		ret = maxNameSerializer.serialize(maxNameInfoMap, buffer);
+		if (ret < 0 || buffer.overflow()) {
+			cerr << "Max-length control name should serialize successfully" << endl;
+			return TestFail;
+		}
+
+		buffer = ByteStreamBuffer(const_cast<const uint8_t *>(infoData.data()),
+					  infoData.size());
+		ControlInfoMap maxNameInfoMapDes =
+			maxNameDeserializer.deserialize<ControlInfoMap>(buffer);
+		auto maxNameIdIt = maxNameInfoMapDes.idmap().find(0x009a2003);
+		if (maxNameIdIt == maxNameInfoMapDes.idmap().end() ||
+		    maxNameIdIt->second->name() != maxName) {
+			cerr << "Max-length control name round-trip failed" << endl;
+			return TestFail;
+		}
+
 		return TestPass;
 	}
 };