From 559a30b0b475de9fa7ba766ad80805d574e574a9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Barnab=C3=A1s=20P=C5=91cze?= <pobrn@protonmail.com>
Date: Fri, 19 Jun 2026 11:34:09 +0200
Subject: [PATCH] spa: libcamera: source: reject buffers with incorrect number
 of planes

`SPA_PARAM_BUFFERS_blocks` is a specific value, the plugin host should
not use any other number of data planes, so reject other values.

For example, the `buffers[i]->n_datas > planes.size()` situation was
not handled correctly, and this removes the need for handling that.
---
 spa/plugins/libcamera/libcamera-source.cpp | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/spa/plugins/libcamera/libcamera-source.cpp b/spa/plugins/libcamera/libcamera-source.cpp
index ff3376e4f..c72860b35 100644
--- a/spa/plugins/libcamera/libcamera-source.cpp
+++ b/spa/plugins/libcamera/libcamera-source.cpp
@@ -1218,8 +1218,8 @@ spa_libcamera_alloc_buffers(struct impl *impl, struct port *port,
 	for (uint32_t i = 0; i < n_buffers; i++) {
 		struct buffer *b;
 
-		if (buffers[i]->n_datas < 1) {
-			spa_log_error(impl->log, "invalid buffer data");
+		if (buffers[i]->n_datas != port->buffers_blocks) {
+			spa_log_error(impl->log, "invalid number of data planes");
 			return -EINVAL;
 		}
 
@@ -1242,6 +1242,8 @@ spa_libcamera_alloc_buffers(struct impl *impl, struct port *port,
 		const auto& planes = bufs[i]->planes();
 		spa_data *d = buffers[i]->datas;
 
+		spa_assert(buffers[i]->n_datas <= planes.size());
+
 		for(uint32_t j = 0; j < buffers[i]->n_datas; ++j) {
 			const auto memtype = choose_memtype(d[j].type);
 			if (memtype == SPA_DATA_Invalid) {
@@ -1257,30 +1259,22 @@ spa_libcamera_alloc_buffers(struct impl *impl, struct port *port,
 			d[j].chunk->stride = port->streamConfig.stride;
 			d[j].chunk->flags = 0;
 			/* Update parameters according to the plane information */
-			unsigned int numPlanes = planes.size();
-			if (buffers[i]->n_datas < numPlanes) {
+			if (buffers[i]->n_datas < planes.size()) {
 				if (j < buffers[i]->n_datas - 1) {
 					d[j].maxsize = planes[j].length;
 					d[j].chunk->offset = planes[j].offset;
 					d[j].chunk->size = planes[j].length;
 				} else {
 					d[j].chunk->offset = planes[j].offset;
-					for (uint8_t k = j; k < numPlanes; k++) {
+					for (uint8_t k = j; k < planes.size(); k++) {
 						d[j].maxsize += planes[k].length;
 						d[j].chunk->size += planes[k].length;
 					}
 				}
-			} else if (buffers[i]->n_datas == numPlanes) {
+			} else {
 				d[j].maxsize = planes[j].length;
 				d[j].chunk->offset = planes[j].offset;
 				d[j].chunk->size = planes[j].length;
-			} else {
-				spa_log_warn(impl->log, "buffer index: i: %d, data member "
-					"numbers: %d is greater than plane number: %d",
-					i, buffers[i]->n_datas, numPlanes);
-				d[j].maxsize = port->streamConfig.frameSize;
-				d[j].chunk->offset = 0;
-				d[j].chunk->size = port->streamConfig.frameSize;
 			}
 
 			switch (memtype) {