@@ -540,6 +540,9 @@ int V4L2CameraProxy::vidioc_querybuf(V4L2CameraFile *cf, struct v4l2_buffer *arg
{
LOG(V4L2Compat, Debug) << "Servicing vidioc_querybuf fd = " << cf->efd();
+ if (arg->index >= bufferCount_)
+ return -EINVAL;
+
int ret = lock(cf);
if (ret < 0)
return ret;
@@ -560,6 +563,9 @@ int V4L2CameraProxy::vidioc_qbuf(V4L2CameraFile *cf, struct v4l2_buffer *arg)
LOG(V4L2Compat, Debug) << "Servicing vidioc_qbuf, index = "
<< arg->index << " fd = " << cf->efd();
+ if (arg->index >= bufferCount_)
+ return -EINVAL;
+
int ret = lock(cf);
if (ret < 0)
return ret;
@@ -586,6 +592,9 @@ int V4L2CameraProxy::vidioc_dqbuf(V4L2CameraFile *cf, struct v4l2_buffer *arg)
if (!vcam_->isRunning())
return -EINVAL;
+ if (arg->index >= bufferCount_)
+ return -EINVAL;
+
int ret = lock(cf);
if (ret < 0)
return ret;