[libcamera-devel] [PATCH v3 2/2] android: CameraDevice: Add more camera3_capture_request validation
Hirokazu Honda
hiroh at chromium.org
Fri Apr 2 04:44:52 CEST 2021
This adds more validation to camera3_capture_request mainly
about buffer_handle values.
Signed-off-by: Hirokazu Honda <hiroh at chromium.org>
---
src/android/camera_device.cpp | 29 +++++++++++++++++++++++++++--
1 file changed, 27 insertions(+), 2 deletions(-)
diff --git a/src/android/camera_device.cpp b/src/android/camera_device.cpp
index 988c1fd5..8b6032fc 100644
--- a/src/android/camera_device.cpp
+++ b/src/android/camera_device.cpp
@@ -263,11 +263,36 @@ bool isValidRequest(camera3_capture_request_t *camera3Request)
return false;
}
- if (!camera3Request->num_output_buffers) {
+ if (!camera3Request->num_output_buffers ||
+ !camera3Request->output_buffers) {
LOG(HAL, Error) << "No output buffers provided";
return false;
}
+ for (uint32_t i = 0; i < camera3Request->num_output_buffers; i++) {
+ const camera3_stream_buffer_t &outputBuffer =
+ camera3Request->output_buffers[i];
+ if (!outputBuffer.buffer || !(*outputBuffer.buffer)) {
+ LOG(HAL, Error) << "Invalid native handle";
+ return false;
+ }
+
+ const native_handle_t *handle = *outputBuffer.buffer;
+ constexpr int kNativeHandleMaxFds = 1024;
+ if (handle->numFds < 0 || handle->numFds > kNativeHandleMaxFds) {
+ LOG(HAL, Error) << "Invalid number of fds: "
+ << handle->numFds;
+ return false;
+ }
+
+ constexpr int kNativeHandleMaxInts = 1024;
+ if (handle->numInts < 0 || handle->numInts > kNativeHandleMaxInts) {
+ LOG(HAL, Error) << "Invalid number of data: "
+ << handle->numInts;
+ return false;
+ }
+ }
+
return true;
}
@@ -1800,7 +1825,7 @@ int CameraDevice::processControls(Camera3RequestDescriptor *descriptor)
int CameraDevice::processCaptureRequest(camera3_capture_request_t *camera3Request)
{
- if (isValidRequest(camera3Request))
+ if (!isValidRequest(camera3Request))
return -EINVAL;
/* Start the camera if that's the first request we handle. */
--
2.31.0.208.g409f899ff0-goog
More information about the libcamera-devel
mailing list