NekoCWD/libcamera
NekoCWD/libcamera
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 7 Wiki Activity Actions

v4l2: v4l2_camera_proxy: Check arg->index bounds for querybuf, qbuf, dqbuf

Browse source 
There were no bounds checks for the index argument for VIDIOC_QUERYBUF,
VIDIOC_QBUF, and VIDIOC_DQBUF. Add them.

Signed-off-by: Paul Elder <paul.elder@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo@jmondi.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
This commit is contained in:
Paul Elder 2020-06-16 19:35:50 +09:00
parent 9909ce33f9
commit 609036a9e6
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
src/v4l2/v4l2_camera_proxy.cpp
View file

@ -539,6 +539,9 @@ int V4L2CameraProxy::vidioc_querybuf(V4L2CameraFile *file, struct v4l2_buffer *a
{ {
LOG(V4L2Compat, Debug) << "Servicing vidioc_querybuf fd = " << file->efd(); LOG(V4L2Compat, Debug) << "Servicing vidioc_querybuf fd = " << file->efd();
if (arg->index >= bufferCount_)
return -EINVAL;
if (!validateBufferType(arg->type) || if (!validateBufferType(arg->type) ||
arg->index >= bufferCount_) arg->index >= bufferCount_)
return -EINVAL; return -EINVAL;
@ -555,6 +558,9 @@ int V4L2CameraProxy::vidioc_qbuf(V4L2CameraFile *file, struct v4l2_buffer *arg)
LOG(V4L2Compat, Debug) << "Servicing vidioc_qbuf, index = " LOG(V4L2Compat, Debug) << "Servicing vidioc_qbuf, index = "
<< arg->index << " fd = " << file->efd(); << arg->index << " fd = " << file->efd();
if (arg->index >= bufferCount_)
return -EINVAL;
if (!hasOwnership(file)) if (!hasOwnership(file))
return -EBUSY; return -EBUSY;
@ -577,6 +583,9 @@ int V4L2CameraProxy::vidioc_dqbuf(V4L2CameraFile *file, struct v4l2_buffer *arg)
{ {
LOG(V4L2Compat, Debug) << "Servicing vidioc_dqbuf fd = " << file->efd(); LOG(V4L2Compat, Debug) << "Servicing vidioc_dqbuf fd = " << file->efd();
if (arg->index >= bufferCount_)
return -EINVAL;
if (!hasOwnership(file)) if (!hasOwnership(file))
return -EBUSY; return -EBUSY;