From patchwork Wed Oct 21 02:47:43 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Laurent Pinchart X-Patchwork-Id: 10155 Return-Path: X-Original-To: parsemail@patchwork.libcamera.org Delivered-To: parsemail@patchwork.libcamera.org Received: from lancelot.ideasonboard.com (lancelot.ideasonboard.com [92.243.16.209]) by patchwork.libcamera.org (Postfix) with ESMTPS id C98CEBDB13 for ; Wed, 21 Oct 2020 02:48:36 +0000 (UTC) Received: from lancelot.ideasonboard.com (localhost [IPv6:::1]) by lancelot.ideasonboard.com (Postfix) with ESMTP id 5310661DA6; Wed, 21 Oct 2020 04:48:36 +0200 (CEST) Authentication-Results: lancelot.ideasonboard.com; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=ideasonboard.com header.i=@ideasonboard.com header.b="JL0DpJRn"; dkim-atps=neutral Received: from perceval.ideasonboard.com (perceval.ideasonboard.com [213.167.242.64]) by lancelot.ideasonboard.com (Postfix) with ESMTPS id 1EB1760350 for ; Wed, 21 Oct 2020 04:48:35 +0200 (CEST) Received: from pendragon.lan (62-78-145-57.bb.dnainternet.fi [62.78.145.57]) by perceval.ideasonboard.com (Postfix) with ESMTPSA id A2C6C92 for ; Wed, 21 Oct 2020 04:48:34 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com; s=mail; t=1603248514; bh=bZbgIcwVG2Enir7oSzr6vgHMDyO0BR75+hlNr+iWWv4=; h=From:To:Subject:Date:From; b=JL0DpJRnyHMZ6t/MZezMh7K1pzlP5Fy1DHMsppliQ3ZNDfEeGQfrtQCzEM/4k/14y Fi8RMuBp8574iYKnoJQG5E2bZzXpkcrYTNBsGw6oEpWkntQiWfmdmtZ6+x204tFmXF dTAQFIFsH8X5vmduEu193r66lMkux5sptN8Epedc= From: Laurent Pinchart To: libcamera-devel@lists.libcamera.org Date: Wed, 21 Oct 2020 05:47:43 +0300 Message-Id: <20201021024744.19047-1-laurent.pinchart@ideasonboard.com> X-Mailer: git-send-email 2.27.0 MIME-Version: 1.0 Subject: [libcamera-devel] [PATCH 1/2] libcamera: v4l2_videodevice: Check plane count when setting format X-BeenThere: libcamera-devel@lists.libcamera.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libcamera-devel-bounces@lists.libcamera.org Sender: "libcamera-devel" When setting (or trying) a format with a multiplanar device, the V4L2VideoDevice::trySetFormatMeta() function iterates over all planes available in the V4L2DeviceFormat structure. The caller is responsible for setting the plane count, and failure to do so properly may result in memory corruption. This can lead to a crash way after the function returns, making the problem difficult to debug. As the issue is caused by a bug in the caller, use an assertion to catch it. Signed-off-by: Laurent Pinchart Reviewed-by: Kieran Bingham Reviewed-by: Niklas Söderlund --- src/libcamera/v4l2_videodevice.cpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/libcamera/v4l2_videodevice.cpp b/src/libcamera/v4l2_videodevice.cpp index 16162e1edba3..3ba9e5ba134a 100644 --- a/src/libcamera/v4l2_videodevice.cpp +++ b/src/libcamera/v4l2_videodevice.cpp @@ -861,6 +861,8 @@ int V4L2VideoDevice::trySetFormatMultiplane(V4L2DeviceFormat *format, bool set) pix->num_planes = format->planesCount; pix->field = V4L2_FIELD_NONE; + ASSERT(pix->num_planes <= ARRAY_SIZE(pix->plane_fmt)); + for (unsigned int i = 0; i < pix->num_planes; ++i) { pix->plane_fmt[i].bytesperline = format->planes[i].bpl; pix->plane_fmt[i].sizeimage = format->planes[i].size; From patchwork Wed Oct 21 02:47:44 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Laurent Pinchart X-Patchwork-Id: 10156 X-Patchwork-Delegate: laurent.pinchart@ideasonboard.com Return-Path: X-Original-To: parsemail@patchwork.libcamera.org Delivered-To: parsemail@patchwork.libcamera.org Received: from lancelot.ideasonboard.com (lancelot.ideasonboard.com [92.243.16.209]) by patchwork.libcamera.org (Postfix) with ESMTPS id 8D230BDB13 for ; Wed, 21 Oct 2020 02:48:37 +0000 (UTC) Received: from lancelot.ideasonboard.com (localhost [IPv6:::1]) by lancelot.ideasonboard.com (Postfix) with ESMTP id A15B161DB7; Wed, 21 Oct 2020 04:48:36 +0200 (CEST) Authentication-Results: lancelot.ideasonboard.com; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=ideasonboard.com header.i=@ideasonboard.com header.b="pObHvMfc"; dkim-atps=neutral Received: from perceval.ideasonboard.com (perceval.ideasonboard.com [IPv6:2001:4b98:dc2:55:216:3eff:fef7:d647]) by lancelot.ideasonboard.com (Postfix) with ESMTPS id 613A960350 for ; Wed, 21 Oct 2020 04:48:35 +0200 (CEST) Received: from pendragon.lan (62-78-145-57.bb.dnainternet.fi [62.78.145.57]) by perceval.ideasonboard.com (Postfix) with ESMTPSA id 01077AEE for ; Wed, 21 Oct 2020 04:48:34 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com; s=mail; t=1603248515; bh=ZmOCmYjbtYARu3ABS32YF+DQnaslIvyvVZXrbXRhZQs=; h=From:To:Subject:Date:In-Reply-To:References:From; b=pObHvMfc6pyAr1M65zMrHLJIowvFcFHrqLUd/vNQyLwifFUCIP1gSu+O6qhR6pYLe gIXtenK84D90XEl1PUa4RaXTfGerMbUsAUhJRiBkpcgxGkRr6mL7VHY++JhfmzE0bY ohVnj2v2Lwgd/UzRiP78sXcH1TP1kUCpfHJa1DVY= From: Laurent Pinchart To: libcamera-devel@lists.libcamera.org Date: Wed, 21 Oct 2020 05:47:44 +0300 Message-Id: <20201021024744.19047-2-laurent.pinchart@ideasonboard.com> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20201021024744.19047-1-laurent.pinchart@ideasonboard.com> References: <20201021024744.19047-1-laurent.pinchart@ideasonboard.com> MIME-Version: 1.0 Subject: [libcamera-devel] [PATCH 2/2] libcamera: pipeline: simple: Initialize V4L2DeviceFormat before use X-BeenThere: libcamera-devel@lists.libcamera.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libcamera-devel-bounces@lists.libcamera.org Sender: "libcamera-devel" The V4L2DeviceFormat has no default constructor. Zero it before use when setting formats. Failure to do so leaves the planes uninitialized, potentially causing memory corruption. Signed-off-by: Laurent Pinchart Reviewed-by: Kieran Bingham Reviewed-by: Niklas Söderlund --- src/libcamera/pipeline/simple/converter.cpp | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/libcamera/pipeline/simple/converter.cpp b/src/libcamera/pipeline/simple/converter.cpp index b4ee021f6210..b3705abcd626 100644 --- a/src/libcamera/pipeline/simple/converter.cpp +++ b/src/libcamera/pipeline/simple/converter.cpp @@ -72,7 +72,7 @@ std::vector SimpleConverter::formats(PixelFormat input) * Set the format on the input side (V4L2 output) of the converter to * enumerate the conversion capabilities on its output (V4L2 capture). */ - V4L2DeviceFormat format; + V4L2DeviceFormat format = {}; format.fourcc = m2m_->output()->toV4L2PixelFormat(input); format.size = { 1, 1 }; @@ -103,7 +103,7 @@ SizeRange SimpleConverter::sizes(const Size &input) * Set the size on the input side (V4L2 output) of the converter to * enumerate the scaling capabilities on its output (V4L2 capture). */ - V4L2DeviceFormat format; + V4L2DeviceFormat format = {}; format.fourcc = V4L2PixelFormat(); format.size = input; @@ -142,7 +142,7 @@ SizeRange SimpleConverter::sizes(const Size &input) int SimpleConverter::configure(PixelFormat inputFormat, const Size &inputSize, StreamConfiguration *cfg) { - V4L2DeviceFormat format; + V4L2DeviceFormat format = {}; int ret; V4L2PixelFormat videoFormat = m2m_->output()->toV4L2PixelFormat(inputFormat);