diff options
author | Emilian Peev <epeev@google.com> | 2018-04-03 13:28:46 +0100 |
---|---|---|
committer | Emilian Peev <epeev@google.com> | 2018-04-03 14:47:39 +0100 |
commit | bc0e16519f6f0b98508720d11be34e871be7470f (patch) | |
tree | 3270e86146bad4b285a11218dc876719815e98f6 /camera/device | |
parent | 584ee3b94ab8d774dbad8401ab589183f8154d4a (diff) | |
download | android_hardware_interfaces-bc0e16519f6f0b98508720d11be34e871be7470f.tar.gz android_hardware_interfaces-bc0e16519f6f0b98508720d11be34e871be7470f.tar.bz2 android_hardware_interfaces-bc0e16519f6f0b98508720d11be34e871be7470f.zip |
Camera: Check external camera v4l2 buffer size
V4L2 buffer size should fall within a reasonable range
like (0. width*height*2]. Check and return appropriate
status in case the size is not within this range.
Bug: 72261912
Test: Camera CTS
Change-Id: I1945dc734afb552ecb8d4ef74c9198eca8ce00e7
Diffstat (limited to 'camera/device')
-rw-r--r-- | camera/device/3.4/default/ExternalCameraDeviceSession.cpp | 13 | ||||
-rw-r--r-- | camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h | 2 |
2 files changed, 15 insertions, 0 deletions
diff --git a/camera/device/3.4/default/ExternalCameraDeviceSession.cpp b/camera/device/3.4/default/ExternalCameraDeviceSession.cpp index 7015bcb44..2c03d81f2 100644 --- a/camera/device/3.4/default/ExternalCameraDeviceSession.cpp +++ b/camera/device/3.4/default/ExternalCameraDeviceSession.cpp @@ -2149,6 +2149,13 @@ int ExternalCameraDeviceSession::configureV4l2StreamLocked( } uint32_t bufferSize = fmt.fmt.pix.sizeimage; ALOGI("%s: V4L2 buffer size is %d", __FUNCTION__, bufferSize); + uint32_t expectedMaxBufferSize = kMaxBytesPerPixel * fmt.fmt.pix.width * fmt.fmt.pix.height; + if ((bufferSize == 0) || (bufferSize > expectedMaxBufferSize)) { + ALOGE("%s: V4L2 buffer size: %u looks invalid. Expected maximum size: %u", __FUNCTION__, + bufferSize, expectedMaxBufferSize); + return -EINVAL; + } + mMaxV4L2BufferSize = bufferSize; const double kDefaultFps = 30.0; double fps = 1000.0; @@ -2296,6 +2303,12 @@ sp<V4L2Frame> ExternalCameraDeviceSession::dequeueV4l2FrameLocked(/*out*/nsecs_t // TODO: try to dequeue again } + if (buffer.bytesused > mMaxV4L2BufferSize) { + ALOGE("%s: v4l2 buffer bytes used: %u maximum %u", __FUNCTION__, buffer.bytesused, + mMaxV4L2BufferSize); + return ret; + } + if (buffer.flags & V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC) { // Ideally we should also check for V4L2_BUF_FLAG_TSTAMP_SRC_SOE, but // even V4L2_BUF_FLAG_TSTAMP_SRC_EOF is better than capture a timestamp now diff --git a/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h b/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h index 53150970e..64134c566 100644 --- a/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h +++ b/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h @@ -108,6 +108,7 @@ struct ExternalCameraDeviceSession : public virtual RefBase { static const int kMaxProcessedStream = 2; static const int kMaxStallStream = 1; + static const uint32_t kMaxBytesPerPixel = 2; protected: @@ -319,6 +320,7 @@ protected: std::mutex mV4l2BufferLock; // protect the buffer count and condition below std::condition_variable mV4L2BufferReturned; size_t mNumDequeuedV4l2Buffers = 0; + uint32_t mMaxV4L2BufferSize = 0; // Not protected by mLock (but might be used when mLock is locked) sp<OutputThread> mOutputThread; |