From 96a5c699700492750183c925339a69da7e2c2326 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Sun, 7 Aug 2022 20:39:19 +0300 Subject: cam: kms_sink: Make lifetime management of DRM request safer The drmRequest is KMSSink::processRequest() is created as a naked pointer, passed to the constructor of the KMSSink::Request object that stores it in a std::unique_ptr<>, and used later in the function. The current implementation is safe, but could be prone to both memory leaks and use-after-free bugs if modified. Improve it by replacing the naked pointer with a std::unique_ptr<>. Signed-off-by: Laurent Pinchart Reviewed-by: Kieran Bingham Reviewed-by: Eric Curtin Tested-by: Kieran Bingham --- src/cam/kms_sink.cpp | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'src/cam/kms_sink.cpp') diff --git a/src/cam/kms_sink.cpp b/src/cam/kms_sink.cpp index 37a3bd50..16435ede 100644 --- a/src/cam/kms_sink.cpp +++ b/src/cam/kms_sink.cpp @@ -301,7 +301,8 @@ bool KMSSink::processRequest(libcamera::Request *camRequest) DRM::FrameBuffer *drmBuffer = iter->second.get(); unsigned int flags = DRM::AtomicRequest::FlagAsync; - DRM::AtomicRequest *drmRequest = new DRM::AtomicRequest(&dev_); + std::unique_ptr drmRequest = + std::make_unique(&dev_); drmRequest->addProperty(plane_, "FB_ID", drmBuffer->id()); if (!active_ && !queued_) { @@ -324,12 +325,12 @@ bool KMSSink::processRequest(libcamera::Request *camRequest) flags |= DRM::AtomicRequest::FlagAllowModeset; } - pending_ = std::make_unique(drmRequest, camRequest); + pending_ = std::make_unique(std::move(drmRequest), camRequest); std::lock_guard lock(lock_); if (!queued_) { - int ret = drmRequest->commit(flags); + int ret = pending_->drmRequest_->commit(flags); if (ret < 0) { std::cerr << "Failed to commit atomic request: " -- cgit v1.2.1