mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2026-06-29 13:14:14 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

spa: libcamera: source: reject buffers with incorrect number of planes

Browse source 
`SPA_PARAM_BUFFERS_blocks` is a specific value, the plugin host should
not use any other number of data planes, so reject other values.

For example, the `buffers[i]->n_datas > planes.size()` situation was
not handled correctly, and this removes the need for handling that.
This commit is contained in:
Barnabás Pőcze 2026-06-19 11:34:09 +02:00 • committed by Wim Taymans
parent 44176d4118
commit 559a30b0b4
1 changed files with 7 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

20
spa/plugins/libcamera/libcamera-source.cpp
View file

@ -1218,8 +1218,8 @@ spa_libcamera_alloc_buffers(struct impl *impl, struct port *port,
for (uint32_t i = 0; i < n_buffers; i++) {
struct buffer *b;
if (buffers[i]->n_datas < 1) {
spa_log_error(impl->log, "invalid buffer data");
if (buffers[i]->n_datas != port->buffers_blocks) {
spa_log_error(impl->log, "invalid number of data planes");
return -EINVAL;
}
@ -1242,6 +1242,8 @@ spa_libcamera_alloc_buffers(struct impl *impl, struct port *port,
const auto& planes = bufs[i]->planes();
spa_data *d = buffers[i]->datas;
spa_assert(buffers[i]->n_datas <= planes.size());
for(uint32_t j = 0; j < buffers[i]->n_datas; ++j) {
const auto memtype = choose_memtype(d[j].type);
if (memtype == SPA_DATA_Invalid) {
@ -1257,30 +1259,22 @@ spa_libcamera_alloc_buffers(struct impl *impl, struct port *port,
d[j].chunk->stride = port->streamConfig.stride;
d[j].chunk->flags = 0;
/* Update parameters according to the plane information */
unsigned int numPlanes = planes.size();
if (buffers[i]->n_datas < numPlanes) {
if (buffers[i]->n_datas < planes.size()) {
if (j < buffers[i]->n_datas - 1) {
d[j].maxsize = planes[j].length;
d[j].chunk->offset = planes[j].offset;
d[j].chunk->size = planes[j].length;
} else {
d[j].chunk->offset = planes[j].offset;
for (uint8_t k = j; k < numPlanes; k++) {
for (uint8_t k = j; k < planes.size(); k++) {
d[j].maxsize += planes[k].length;
d[j].chunk->size += planes[k].length;
}
}
} else if (buffers[i]->n_datas == numPlanes) {
} else {
d[j].maxsize = planes[j].length;
d[j].chunk->offset = planes[j].offset;
d[j].chunk->size = planes[j].length;
} else {
spa_log_warn(impl->log, "buffer index: i: %d, data member "
"numbers: %d is greater than plane number: %d",
i, buffers[i]->n_datas, numPlanes);
d[j].maxsize = port->streamConfig.frameSize;
d[j].chunk->offset = 0;
d[j].chunk->size = port->streamConfig.frameSize;
}
switch (memtype) {