blue-debug commented on code in PR #21471:
URL: https://github.com/apache/nuttx/pull/21471#discussion_r4492045810
##########
drivers/video/v4l2_cap.c:
##########
@@ -2548,15 +2581,42 @@ static int capture_qbuf(FAR struct file *filep,
FAR capture_mng_t *cmng = inode->i_private;
FAR capture_type_inf_t *type_inf;
FAR vbuf_container_t *container;
+ FAR vbuf_container_t *queued;
enum capture_state_e next_capture_state;
+ int ret = OK;
if (cmng == NULL || buf == NULL)
{
return -EINVAL;
}
type_inf = get_capture_type_inf(cmng, buf->type);
- if (type_inf == NULL)
+ if (type_inf == NULL ||
+ buf->index >= type_inf->bufinf.container_size)
+ {
+ return -EINVAL;
+ }
+
+#ifdef CONFIG_DMA_SHARED_BUFFER
+ if (buf->memory != V4L2_MEMORY_MMAP &&
+ buf->memory != V4L2_MEMORY_USERPTR &&
+ buf->memory != V4L2_MEMORY_DMABUF)
+#else
+ if (buf->memory != V4L2_MEMORY_MMAP &&
+ buf->memory != V4L2_MEMORY_USERPTR)
+#endif
+ {
+ return -EINVAL;
+ }
+
+ if (buf->memory == V4L2_MEMORY_MMAP && type_inf->bufheap == NULL)
+ {
+ return -EINVAL;
+ }
+
+ if (buf->memory == V4L2_MEMORY_USERPTR &&
+ (buf->m.userptr == 0 ||
+ buf->length < get_bufsize(&type_inf->fmt[CAPTURE_FMT_MAIN])))
Review Comment:
- QBUF (d1f5400f045): USERPTR length check gated on a new
is_bufsize_exact(), so JPEG without sizeimage is accepted again.
##########
drivers/video/v4l2_cap.c:
##########
@@ -4194,16 +4302,20 @@ static int capture_unlink(FAR struct inode *inode)
}
nxmutex_lock(&cmng->mutex);
+ cmng->unlinked = true;
+
if (cmng->open_num == 0)
{
+ inode->i_private = NULL;
nxmutex_unlock(&cmng->mutex);
+ cleanup_resources(cmng);
Review Comment:
- capture_unlink (60e3034f052): cleanup calls dropped from the open_num == 0
path — capture_close() already owns them.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
