summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDavid Plowman <david.plowman@raspberrypi.com>2021-09-28 16:36:34 +0100
committerLaurent Pinchart <laurent.pinchart@ideasonboard.com>2021-10-05 15:19:04 +0300
commita733e0647a2c3cbbacac9110b01afa1e2a2d68d7 (patch)
tree8c14203a9684bd0d81611e67b73d6123096baa7a
parent1de0f90dd43200b0f101b8c732c35c2669d027ad (diff)
libcamera: Fix crash caused by reading uninitialised delayed controls
The cause is that we read out delayed values using a frame's sequence number (DelayedControls::get). But we fill the values up (DelayedControls::applyControls) incrementing writeCount by only one even if the sequence number has jumped by several since last time. This is exactly what happens when frames are being dropped. So the fix is to increment writeCount by "as much as the sequence number has jumped since last time", which means that we just follow the sequence number directly. Bug: https://bugs.libcamera.org/show_bug.cgi?id=74 Signed-off-by: David Plowman <david.plowman@raspberrypi.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Naushir Patuck <naush@raspberrypi.com> Tested-by: Naushir Patuck <naush@raspberrypi.com> Tested-by: Jacopo Mondi <jacopo@jmondi.org> Reviewed-by: Jacopo Mondi <jacopo@jmondi.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
-rw-r--r--src/libcamera/delayed_controls.cpp2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/libcamera/delayed_controls.cpp b/src/libcamera/delayed_controls.cpp
index 90ce7e0b..9667187e 100644
--- a/src/libcamera/delayed_controls.cpp
+++ b/src/libcamera/delayed_controls.cpp
@@ -279,7 +279,7 @@ void DelayedControls::applyControls(uint32_t sequence)
}
}
- writeCount_++;
+ writeCount_ = sequence - firstSequence_ + 1;
while (writeCount_ > queueCount_) {
LOG(DelayedControls, Debug)