summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLaurent Pinchart <laurent.pinchart@ideasonboard.com>2020-10-21 05:02:59 +0300
committerLaurent Pinchart <laurent.pinchart@ideasonboard.com>2020-11-07 20:24:31 +0200
commite9463449049c78b6b1c61410082a5339338b2e81 (patch)
tree1ea8c21e8b356a803af1845d5f75e58bfae782a2
parent2d43b8bcd8571dbce1969fa1fd50c655585f780b (diff)
libcamera: v4l2_videodevice: Check plane count when setting format
When setting (or trying) a format with a multiplanar device, the V4L2VideoDevice::trySetFormatMeta() function iterates over all planes available in the V4L2DeviceFormat structure. The caller is responsible for setting the plane count, and failure to do so properly may result in memory corruption. This can lead to a crash way after the function returns, making the problem difficult to debug. As the issue is caused by a bug in the caller, use an assertion to catch it. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Niklas Söderlund <niklas.soderlund@ragnatech.se> Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
-rw-r--r--src/libcamera/v4l2_videodevice.cpp2
1 files changed, 2 insertions, 0 deletions
diff --git a/src/libcamera/v4l2_videodevice.cpp b/src/libcamera/v4l2_videodevice.cpp
index d07c3530..ac3c8c7d 100644
--- a/src/libcamera/v4l2_videodevice.cpp
+++ b/src/libcamera/v4l2_videodevice.cpp
@@ -870,6 +870,8 @@ int V4L2VideoDevice::trySetFormatMultiplane(V4L2DeviceFormat *format, bool set)
pix->num_planes = format->planesCount;
pix->field = V4L2_FIELD_NONE;
+ ASSERT(pix->num_planes <= ARRAY_SIZE(pix->plane_fmt));
+
for (unsigned int i = 0; i < pix->num_planes; ++i) {
pix->plane_fmt[i].bytesperline = format->planes[i].bpl;
pix->plane_fmt[i].sizeimage = format->planes[i].size;