diff options
| author | David Plowman <david.plowman@raspberrypi.com> | 2021-09-28 16:36:34 +0100 |
|---|---|---|
| committer | Laurent Pinchart <laurent.pinchart@ideasonboard.com> | 2021-10-05 15:19:04 +0300 |
| commit | a733e0647a2c3cbbacac9110b01afa1e2a2d68d7 (patch) | |
| tree | 8c14203a9684bd0d81611e67b73d6123096baa7a | |
| parent | 1de0f90dd43200b0f101b8c732c35c2669d027ad (diff) | |
libcamera: Fix crash caused by reading uninitialised delayed controls
The cause is that we read out delayed values using a frame's sequence
number (DelayedControls::get). But we fill the values up
(DelayedControls::applyControls) incrementing writeCount by only one
even if the sequence number has jumped by several since last
time. This is exactly what happens when frames are being dropped.
So the fix is to increment writeCount by "as much as the sequence
number has jumped since last time", which means that we just follow
the sequence number directly.
Bug: https://bugs.libcamera.org/show_bug.cgi?id=74
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Naushir Patuck <naush@raspberrypi.com>
Tested-by: Naushir Patuck <naush@raspberrypi.com>
Tested-by: Jacopo Mondi <jacopo@jmondi.org>
Reviewed-by: Jacopo Mondi <jacopo@jmondi.org>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
| -rw-r--r-- | src/libcamera/delayed_controls.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/libcamera/delayed_controls.cpp b/src/libcamera/delayed_controls.cpp index 90ce7e0b..9667187e 100644 --- a/src/libcamera/delayed_controls.cpp +++ b/src/libcamera/delayed_controls.cpp @@ -279,7 +279,7 @@ void DelayedControls::applyControls(uint32_t sequence) } } - writeCount_++; + writeCount_ = sequence - firstSequence_ + 1; while (writeCount_ > queueCount_) { LOG(DelayedControls, Debug) |