[libcamera-devel] [PATCH v3 18/22] v4l2: v4l2_camera_proxy: Check arg->index bounds for querybuf, qbuf, dqbuf
Paul Elder
paul.elder at ideasonboard.com
Tue Jun 23 21:08:32 CEST 2020
There were no bounds checks for the index argument for VIDIOC_QUERYBUF,
VIDIOC_QBUF, and VIDIOC_DQBUF. Add them.
Signed-off-by: Paul Elder <paul.elder at ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo at jmondi.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart at ideasonboard.com>
---
Changes in v3:
- don't check for ownership on querybuf
No change in v2
---
src/v4l2/v4l2_camera_proxy.cpp | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/src/v4l2/v4l2_camera_proxy.cpp b/src/v4l2/v4l2_camera_proxy.cpp
index 8420e23..0e87631 100644
--- a/src/v4l2/v4l2_camera_proxy.cpp
+++ b/src/v4l2/v4l2_camera_proxy.cpp
@@ -545,6 +545,9 @@ int V4L2CameraProxy::vidioc_querybuf(V4L2CameraFile *file, struct v4l2_buffer *a
{
LOG(V4L2Compat, Debug) << "Servicing vidioc_querybuf fd = " << file->efd();
+ if (arg->index >= bufferCount_)
+ return -EINVAL;
+
if (!validateBufferType(arg->type) ||
arg->index >= bufferCount_)
return -EINVAL;
@@ -561,6 +564,9 @@ int V4L2CameraProxy::vidioc_qbuf(V4L2CameraFile *file, struct v4l2_buffer *arg)
LOG(V4L2Compat, Debug) << "Servicing vidioc_qbuf, index = "
<< arg->index << " fd = " << file->efd();
+ if (arg->index >= bufferCount_)
+ return -EINVAL;
+
if (!hasOwnership(file))
return -EBUSY;
@@ -583,6 +589,9 @@ int V4L2CameraProxy::vidioc_dqbuf(V4L2CameraFile *file, struct v4l2_buffer *arg)
{
LOG(V4L2Compat, Debug) << "Servicing vidioc_dqbuf fd = " << file->efd();
+ if (arg->index >= bufferCount_)
+ return -EINVAL;
+
if (!hasOwnership(file))
return -EBUSY;
--
2.27.0
More information about the libcamera-devel
mailing list