[libcamera-devel] [PATCH] libcamera: raspberry: Fix segfault in ~RPiCameraData()

[Laurent Pinchart]

Hi Jacopo,

Thank you for the patch.

On Wed, May 20, 2020 at 05:10:19PM +0200, Jacopo Mondi wrote:
> The RPiCameraData class destructor tries to stop its ipa_ instance
> without making sure it has been initialized.
> 
> If the RPiCameraData gets destroyed before its ipa_ member is
> initialized, in example if the sensor initialization fails during the

s/in example/for example/

> match() function. A nullptr dereference segfault is triggered preventing

s/. A/, a/

> a graceful library teardown.
> 
> Fix this by checking for ipa_ to be initialized before stopping it.
> 
> Signed-off-by: Jacopo Mondi <jacopo at jmondi.org>
> ---
>  src/libcamera/pipeline/raspberrypi/raspberrypi.cpp | 3 ++-
>  src/libcamera/property_ids.yaml                    | 1 -
>  2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp b/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp
> index 07ca9f5d7f53..e16a9c7f10d3 100644
> --- a/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp
> +++ b/src/libcamera/pipeline/raspberrypi/raspberrypi.cpp
> @@ -304,7 +304,8 @@ public:
>  		}
>  
>  		/* Stop the IPA proxy thread. */
> -		ipa_->stop();
> +		if (ipa_)
> +			ipa_->stop();
>  	}
>  
>  	void frameStarted(uint32_t sequence);
> diff --git a/src/libcamera/property_ids.yaml b/src/libcamera/property_ids.yaml
> index 2ae178a73d52..da4d0bbf329c 100644
> --- a/src/libcamera/property_ids.yaml
> +++ b/src/libcamera/property_ids.yaml
> @@ -398,7 +398,6 @@ controls:
>          The property can be used to calculate the physical size of the sensor's
>          pixel array.
>  
> -

With this hunk removed,

Reviewed-by: Laurent Pinchart <laurent.pinchart at ideasonboard.com>

>    - PixelArrayFullSize:
>        type: Size
>        description: |

-- 
Regards,

Laurent Pinchart