From 20f295e4512a28c0de16f088ac48ab104dca9336 Mon Sep 17 00:00:00 2001 From: Nicholas Roth Date: Sat, 19 Nov 2022 23:06:29 -0600 Subject: android: Fix improper file descriptor enumeration Currently, they way camera_device.cpp handles file descriptors in a buffer_handle_t is incorrect. This can result in the HAL attempting to treat uninitialized memory like file descriptors, usually resulting in a crash. This patch brings the behavior of camera_device.cpp in line with how CameraBuffer handles file descriptors and planes. Bug: https://bugs.libcamera.org/show_bug.cgi?id=172 Signed-off-by: Nicholas Roth --- src/android/camera_device.cpp | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/src/android/camera_device.cpp b/src/android/camera_device.cpp index b20e389b..1459d582 100644 --- a/src/android/camera_device.cpp +++ b/src/android/camera_device.cpp @@ -781,14 +781,18 @@ CameraDevice::createFrameBuffer(const buffer_handle_t camera3buffer, return nullptr; } + if (camera3buffer->numFds > 1) { + LOG(HAL, Fatal) << "Discontiguous planes are not supported"; + } + + SharedFD fd{ camera3buffer->data[0] }; + if (!fd.isValid()) { + LOG(HAL, Fatal) << "No valid fd"; + return nullptr; + } + std::vector planes(buf.numPlanes()); for (size_t i = 0; i < buf.numPlanes(); ++i) { - SharedFD fd{ camera3buffer->data[i] }; - if (!fd.isValid()) { - LOG(HAL, Fatal) << "No valid fd"; - return nullptr; - } - planes[i].fd = fd; planes[i].offset = buf.offset(i); planes[i].length = buf.size(i); -- cgit v1.2.1