From patchwork Sat Apr 3 13:37:40 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hirokazu Honda X-Patchwork-Id: 11830 Return-Path: X-Original-To: parsemail@patchwork.libcamera.org Delivered-To: parsemail@patchwork.libcamera.org Received: from lancelot.ideasonboard.com (lancelot.ideasonboard.com [92.243.16.209]) by patchwork.libcamera.org (Postfix) with ESMTPS id 5C98EBD695 for ; Sat, 3 Apr 2021 13:37:51 +0000 (UTC) Received: from lancelot.ideasonboard.com (localhost [IPv6:::1]) by lancelot.ideasonboard.com (Postfix) with ESMTP id C74CB6877E; Sat, 3 Apr 2021 15:37:50 +0200 (CEST) Authentication-Results: lancelot.ideasonboard.com; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=chromium.org header.i=@chromium.org header.b="UhsNhyei"; dkim-atps=neutral Received: from mail-pg1-x532.google.com (mail-pg1-x532.google.com [IPv6:2607:f8b0:4864:20::532]) by lancelot.ideasonboard.com (Postfix) with ESMTPS id 5C52E602CF for ; Sat, 3 Apr 2021 15:37:49 +0200 (CEST) Received: by mail-pg1-x532.google.com with SMTP id k8so5240344pgf.4 for ; Sat, 03 Apr 2021 06:37:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=t6notvtEduCbgHjICfAQiA3fscbYZUm2hqc/YBsESnY=; b=UhsNhyei+eAi4kJMOOx5ei3iDJ/GhYpJla8pVLf/MNGGppJaNT8Z5WmwHkqxm7p/+t Q8mzEc5KtFrTGy0IrmHYgLZuEO9hsvxLw7Ge8Za1kkVZn/NdIWpnIedWu8A5zr70FKff lyhxcPGMF0TCKcVJyVq8g0kQkhC4HIKN1GEdk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=t6notvtEduCbgHjICfAQiA3fscbYZUm2hqc/YBsESnY=; b=SSxo6lLVkpCLafJnxS5yAHIu9PknZAmUP6+nZguJn1rWpNekdGwwnLnBxI8wjpvAWd +I6GSvrL+vuCMrCp2ddVMhicF174DzYLg39hDYndE8Rkz6VCJhEPBeE1yGX+nkYz8SkG 26u8C366xJNZE4zTYQmgKJ5UeAvVRFC4H28srQ/g8dUj2bG/pewSe/8txu46Z+TGDUr5 RLLRvRtkNr029f7iVuGqclWdUGvfUKIiWcSyzefnokoVbhSLxTJ/DSzPeE1MyBPY8o/h nvrFgaSkHHv1TzfPXTK/KskRsfe4UO2qLIjOQaZrvmvAOZ7EPc3EfjtwwpzXqLP5OedS SGjA== X-Gm-Message-State: AOAM531iwgQvD4jJ9mlV6Owfx4JrYiwMAsbrkOtIbwcuCGKLaY+d7/sp iBG4CLuGt1wpI25oGr3XW16OXyfdgBqcIQ== X-Google-Smtp-Source: ABdhPJw86qNwYGBL3JaqccPXaiGCc9LYeUNT+7b6Tyymkv82ek38dzxQjXkAnrocL6USF1g1Ba2fww== X-Received: by 2002:aa7:9edb:0:b029:202:ec35:a893 with SMTP id r27-20020aa79edb0000b0290202ec35a893mr8141248pfq.22.1617457067708; Sat, 03 Apr 2021 06:37:47 -0700 (PDT) Received: from hiroh2.tok.corp.google.com ([2401:fa00:8f:2:d1f5:1b96:f027:f646]) by smtp.gmail.com with ESMTPSA id s17sm10997414pfc.53.2021.04.03.06.37.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 03 Apr 2021 06:37:47 -0700 (PDT) From: Hirokazu Honda To: libcamera-devel@lists.libcamera.org Date: Sat, 3 Apr 2021 22:37:40 +0900 Message-Id: <20210403133741.1595440-1-hiroh@chromium.org> X-Mailer: git-send-email 2.31.0.208.g409f899ff0-goog MIME-Version: 1.0 Subject: [libcamera-devel] [PATCH v4 1/2] android: cameraDevice: Factorize the code of validating camera3_capture_request X-BeenThere: libcamera-devel@lists.libcamera.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libcamera-devel-bounces@lists.libcamera.org Sender: "libcamera-devel" CameraDevice::processCaptureRequest() checks the validness of a provided camera3_capture_request. This factorizes the code in order to add more validation to the request later. Signed-off-by: Hirokazu Honda Reviewed-by: Jacopo Mondi Reviewed-by: Kieran Bingham Reviewed-by: Laurent Pinchart --- src/android/camera_device.cpp | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/src/android/camera_device.cpp b/src/android/camera_device.cpp index eb327978..d8ce43be 100644 --- a/src/android/camera_device.cpp +++ b/src/android/camera_device.cpp @@ -256,6 +256,21 @@ void sortCamera3StreamConfigs(std::vector &unsortedConfigs, unsortedConfigs = sortedConfigs; } +bool isValidRequest(camera3_capture_request_t *camera3Request) +{ + if (!camera3Request) { + LOG(HAL, Error) << "No capture request provided"; + return false; + } + + if (!camera3Request->num_output_buffers) { + LOG(HAL, Error) << "No output buffers provided"; + return false; + } + + return true; +} + } /* namespace */ /* @@ -1785,15 +1800,8 @@ int CameraDevice::processControls(Camera3RequestDescriptor *descriptor) int CameraDevice::processCaptureRequest(camera3_capture_request_t *camera3Request) { - if (!camera3Request) { - LOG(HAL, Error) << "No capture request provided"; + if (!isValidRequest(camera3Request)) return -EINVAL; - } - - if (!camera3Request->num_output_buffers) { - LOG(HAL, Error) << "No output buffers provided"; - return -EINVAL; - } /* Start the camera if that's the first request we handle. */ if (!running_) { From patchwork Sat Apr 3 13:37:41 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hirokazu Honda X-Patchwork-Id: 11831 Return-Path: X-Original-To: parsemail@patchwork.libcamera.org Delivered-To: parsemail@patchwork.libcamera.org Received: from lancelot.ideasonboard.com (lancelot.ideasonboard.com [92.243.16.209]) by patchwork.libcamera.org (Postfix) with ESMTPS id 7518BBD695 for ; Sat, 3 Apr 2021 13:37:52 +0000 (UTC) Received: from lancelot.ideasonboard.com (localhost [IPv6:::1]) by lancelot.ideasonboard.com (Postfix) with ESMTP id 3996368786; Sat, 3 Apr 2021 15:37:52 +0200 (CEST) Authentication-Results: lancelot.ideasonboard.com; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=chromium.org header.i=@chromium.org header.b="VqAeYNAV"; dkim-atps=neutral Received: from mail-pg1-x532.google.com (mail-pg1-x532.google.com [IPv6:2607:f8b0:4864:20::532]) by lancelot.ideasonboard.com (Postfix) with ESMTPS id D413D68786 for ; Sat, 3 Apr 2021 15:37:50 +0200 (CEST) Received: by mail-pg1-x532.google.com with SMTP id q10so5248417pgj.2 for ; Sat, 03 Apr 2021 06:37:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=Dr8dpFFyZeN1I/qolmaSk2O3tNXaJmhJhLsMo02LvB0=; b=VqAeYNAVns2eyDCktqIiv52iiSRDxR6FzC9eONeu2LmxhOxmf/9XklYTWA8mG4SDKN b8d3inizKEDpsqVqIGiy2KEJhlp0lrbmMKXw/74BBYV7Mx3vCF1IsIhQZGrh7YQta4Cs Sr6dkJHV11OeMqWgpIHcs5ypUGWGFyZLuEhtk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Dr8dpFFyZeN1I/qolmaSk2O3tNXaJmhJhLsMo02LvB0=; b=Go9q9kmp96Ju6s2YipxxQBQddl3iLJUcytDxsph4lxYlQcy3VuKYRLMJXH558zRxXw TLIvE3vDoaLKtnVvLAMYORu5fZngCcF3li0UrBVWyg+8TYAOqvcNd8C2safTiF5hoUzA QQg9LM/oyw7IExlK4lf8gBnkd6/PkdI9itFq8ubri95IrUk+EFJrV/7TikAvdQnFoYxx ZIH9VQiwZxbsT5rfYW/SESd9xzasys7wDx3G0QsUTEeniYTFbVQt9SLZX1AN9ZBs5dR/ PbjdqXW2JIy9rDWxj9J0wsxpmMEgd4vswzaw7BPryx7X8gVIoEdWC+Gp5ob3OoLom/UK qnWg== X-Gm-Message-State: AOAM531X8Is9RyPVSHhrcVJqbvvAOQQAD8UYz39om2dpdZgn2RYy4HUC FMcVUa6SoDwp1M0ZpTGBJc/YLthChYnrdw== X-Google-Smtp-Source: ABdhPJwRMoiAi7MplpdhD3kC4TEshF3cXsI4gM1sKNsQ4dTWKaYtd57JqEEa3FEvSj41D8w/s/ue6A== X-Received: by 2002:a05:6a00:174a:b029:1fc:d9ba:da96 with SMTP id j10-20020a056a00174ab02901fcd9bada96mr16458119pfc.40.1617457069360; Sat, 03 Apr 2021 06:37:49 -0700 (PDT) Received: from hiroh2.tok.corp.google.com ([2401:fa00:8f:2:d1f5:1b96:f027:f646]) by smtp.gmail.com with ESMTPSA id s17sm10997414pfc.53.2021.04.03.06.37.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 03 Apr 2021 06:37:48 -0700 (PDT) From: Hirokazu Honda To: libcamera-devel@lists.libcamera.org Date: Sat, 3 Apr 2021 22:37:41 +0900 Message-Id: <20210403133741.1595440-2-hiroh@chromium.org> X-Mailer: git-send-email 2.31.0.208.g409f899ff0-goog In-Reply-To: <20210403133741.1595440-1-hiroh@chromium.org> References: <20210403133741.1595440-1-hiroh@chromium.org> MIME-Version: 1.0 Subject: [libcamera-devel] [PATCH v4 2/2] android: CameraDevice: Add more camera3_capture_request validation X-BeenThere: libcamera-devel@lists.libcamera.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libcamera-devel-bounces@lists.libcamera.org Sender: "libcamera-devel" This adds more validation to camera3_capture_request mainly about buffer_handle values. Signed-off-by: Hirokazu Honda Reviewed-by: Laurent Pinchart --- src/android/camera_device.cpp | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/src/android/camera_device.cpp b/src/android/camera_device.cpp index d8ce43be..91791a10 100644 --- a/src/android/camera_device.cpp +++ b/src/android/camera_device.cpp @@ -263,11 +263,38 @@ bool isValidRequest(camera3_capture_request_t *camera3Request) return false; } - if (!camera3Request->num_output_buffers) { + if (!camera3Request->num_output_buffers || + !camera3Request->output_buffers) { LOG(HAL, Error) << "No output buffers provided"; return false; } + for (uint32_t i = 0; i < camera3Request->num_output_buffers; i++) { + const camera3_stream_buffer_t &outputBuffer = + camera3Request->output_buffers[i]; + if (!outputBuffer.buffer || !(*outputBuffer.buffer)) { + LOG(HAL, Error) << "Invalid native handle"; + return false; + } + + const native_handle_t *handle = *outputBuffer.buffer; + constexpr int kNativeHandleMaxFds = 1024; + if (handle->numFds < 0 || handle->numFds > kNativeHandleMaxFds) { + LOG(HAL, Error) + << "Invalid number of fds (" << handle->numFds + << ") in buffer " << i; + return false; + } + + constexpr int kNativeHandleMaxInts = 1024; + if (handle->numInts < 0 || handle->numInts > kNativeHandleMaxInts) { + LOG(HAL, Error) + << "Invalid number of ints (" << handle->numInts + << ") in buffer " << i; + return false; + } + } + return true; }