NekoCWD/libcamera
NekoCWD/libcamera
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 7 Wiki Activity Actions

libcamera: pipeline: ipu3: Ensure that IPU3Frames::info is not used after delete

Browse source 
When the IPU3Frames completes, it deletes the internal info storage.

This storage contains the pointer to the Request, but in some cases the
pointer was being accessed after the info structure was removed.

Ensure that the Request is obtained before attempting to complete to
obtain a valid pointer.

Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo@jmondi.org>
Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
This commit is contained in:
Kieran Bingham 2021-03-03 17:04:25 +00:00
parent 49667ad8e5
commit 2fac95b400
1 changed files with 20 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

22
src/libcamera/pipeline/ipu3/ipu3.cpp
View file

@ -1164,6 +1164,7 @@ void IPU3CameraData::queueFrameAction(unsigned int id,
* in action.controls to register additional metadata.
*/
Request *request = info->request;
info->metadataProcessed = true;
if (frameInfos_.tryComplete(info))
pipe_->completeRequest(request);
@ -1253,8 +1254,17 @@ void IPU3CameraData::paramBufferReady(FrameBuffer *buffer)
return;
info->paramDequeued = true;
/*
* tryComplete() will delete info if it completes the IPU3Frame.
* In that event, we must have obtained the Request before hand.
*
* \todo Improve the FrameInfo API to avoid this type of issue
*/
Request *request = info->request;
if (frameInfos_.tryComplete(info))
pipe_->completeRequest(info->request);
pipe_->completeRequest(request);
}
void IPU3CameraData::statBufferReady(FrameBuffer *buffer)
@ -1265,8 +1275,16 @@ void IPU3CameraData::statBufferReady(FrameBuffer *buffer)
if (buffer->metadata().status == FrameMetadata::FrameCancelled) {
info->metadataProcessed = true;
/*
* tryComplete() will delete info if it completes the IPU3Frame.
* In that event, we must have obtained the Request before hand.
*/
Request *request = info->request;
if (frameInfos_.tryComplete(info))
pipe_->completeRequest(info->request);
pipe_->completeRequest(request);
return;
}