summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorLaurent Pinchart <laurent.pinchart@ideasonboard.com>2020-10-21 05:02:59 +0300
committerLaurent Pinchart <laurent.pinchart@ideasonboard.com>2020-11-07 20:24:31 +0200
commite9463449049c78b6b1c61410082a5339338b2e81 (patch)
tree1ea8c21e8b356a803af1845d5f75e58bfae782a2 /src
parent2d43b8bcd8571dbce1969fa1fd50c655585f780b (diff)
libcamera: v4l2_videodevice: Check plane count when setting format
When setting (or trying) a format with a multiplanar device, the V4L2VideoDevice::trySetFormatMeta() function iterates over all planes available in the V4L2DeviceFormat structure. The caller is responsible for setting the plane count, and failure to do so properly may result in memory corruption. This can lead to a crash way after the function returns, making the problem difficult to debug. As the issue is caused by a bug in the caller, use an assertion to catch it. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Niklas Söderlund <niklas.soderlund@ragnatech.se> Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Diffstat (limited to 'src')
-rw-r--r--src/libcamera/v4l2_videodevice.cpp2
1 files changed, 2 insertions, 0 deletions
diff --git a/src/libcamera/v4l2_videodevice.cpp b/src/libcamera/v4l2_videodevice.cpp
index d07c3530..ac3c8c7d 100644
--- a/src/libcamera/v4l2_videodevice.cpp
+++ b/src/libcamera/v4l2_videodevice.cpp
@@ -870,6 +870,8 @@ int V4L2VideoDevice::trySetFormatMultiplane(V4L2DeviceFormat *format, bool set)
pix->num_planes = format->planesCount;
pix->field = V4L2_FIELD_NONE;
+ ASSERT(pix->num_planes <= ARRAY_SIZE(pix->plane_fmt));
+
for (unsigned int i = 0; i < pix->num_planes; ++i) {
pix->plane_fmt[i].bytesperline = format->planes[i].bpl;
pix->plane_fmt[i].sizeimage = format->planes[i].size;