From 7ac934e0c5420814c7a5fc3e2a2f08251d590d9e Mon Sep 17 00:00:00 2001 From: claude-noether Date: Thu, 14 May 2026 18:55:27 +0000 Subject: [PATCH] iter38b: bounds check uses MAX_PROFILES (11), not MAX_CONFIG_ATTRIBUTES (10) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Latent bug surfaced by iter38 multi-device probe. profiles[] array in RequestQueryConfigProfiles is sized by V4L2_REQUEST_MAX_PROFILES (set as context->max_profiles=11 in VA_DRIVER_INIT), but the bounds checks used V4L2_REQUEST_MAX_CONFIG_ATTRIBUTES (10). Pre-iter38 only a single device's profiles were enumerated, total ≤9, so the off-by- one never bit. With iter38's rkvdec+hantro union (10 profiles total across MPEG2/H264/HEVC/VP8/VP9), the last enumerator (VP9) hit index=9 with the check 'index < 10-1 = 9' → skipped. --- src/config.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/config.c b/src/config.c index 7fea711..5d38408 100644 --- a/src/config.c +++ b/src/config.c @@ -181,13 +181,13 @@ VAStatus RequestQueryConfigProfiles(VADriverContextP context, bool found; found = any_fd_supports_output_format(driver_data, V4L2_PIX_FMT_MPEG2_SLICE); - if (found && index < (V4L2_REQUEST_MAX_CONFIG_ATTRIBUTES - 2)) { + if (found && index < (V4L2_REQUEST_MAX_PROFILES - 2)) { profiles[index++] = VAProfileMPEG2Simple; profiles[index++] = VAProfileMPEG2Main; } found = any_fd_supports_output_format(driver_data, V4L2_PIX_FMT_H264_SLICE); - if (found && index < (V4L2_REQUEST_MAX_CONFIG_ATTRIBUTES - 5)) { + if (found && index < (V4L2_REQUEST_MAX_PROFILES - 5)) { profiles[index++] = VAProfileH264Main; profiles[index++] = VAProfileH264High; profiles[index++] = VAProfileH264ConstrainedBaseline; @@ -196,15 +196,15 @@ VAStatus RequestQueryConfigProfiles(VADriverContextP context, } found = any_fd_supports_output_format(driver_data, V4L2_PIX_FMT_HEVC_SLICE); - if (found && index < (V4L2_REQUEST_MAX_CONFIG_ATTRIBUTES - 1)) + if (found && index < (V4L2_REQUEST_MAX_PROFILES - 1)) profiles[index++] = VAProfileHEVCMain; found = any_fd_supports_output_format(driver_data, V4L2_PIX_FMT_VP8_FRAME); - if (found && index < (V4L2_REQUEST_MAX_CONFIG_ATTRIBUTES - 1)) + if (found && index < (V4L2_REQUEST_MAX_PROFILES - 1)) profiles[index++] = VAProfileVP8Version0_3; found = any_fd_supports_output_format(driver_data, V4L2_PIX_FMT_VP9_FRAME); - if (found && index < (V4L2_REQUEST_MAX_CONFIG_ATTRIBUTES - 1)) + if (found && index < (V4L2_REQUEST_MAX_PROFILES - 1)) profiles[index++] = VAProfileVP9Profile0; *profiles_count = index;