From a733e0647a2c3cbbacac9110b01afa1e2a2d68d7 Mon Sep 17 00:00:00 2001 From: David Plowman Date: Tue, 28 Sep 2021 16:36:34 +0100 Subject: libcamera: Fix crash caused by reading uninitialised delayed controls The cause is that we read out delayed values using a frame's sequence number (DelayedControls::get). But we fill the values up (DelayedControls::applyControls) incrementing writeCount by only one even if the sequence number has jumped by several since last time. This is exactly what happens when frames are being dropped. So the fix is to increment writeCount by "as much as the sequence number has jumped since last time", which means that we just follow the sequence number directly. Bug: https://bugs.libcamera.org/show_bug.cgi?id=74 Signed-off-by: David Plowman Reviewed-by: Laurent Pinchart Reviewed-by: Naushir Patuck Tested-by: Naushir Patuck Tested-by: Jacopo Mondi Reviewed-by: Jacopo Mondi Signed-off-by: Laurent Pinchart --- src/libcamera/delayed_controls.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/libcamera/delayed_controls.cpp') diff --git a/src/libcamera/delayed_controls.cpp b/src/libcamera/delayed_controls.cpp index 90ce7e0b..9667187e 100644 --- a/src/libcamera/delayed_controls.cpp +++ b/src/libcamera/delayed_controls.cpp @@ -279,7 +279,7 @@ void DelayedControls::applyControls(uint32_t sequence) } } - writeCount_++; + writeCount_ = sequence - firstSequence_ + 1; while (writeCount_ > queueCount_) { LOG(DelayedControls, Debug) -- cgit v1.2.1