marfrit/libva-v4l2-request-fourier
1
0
Fork 1
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

iter38b: bounds check uses MAX_PROFILES (11), not MAX_CONFIG_ATTRIBUTES (10)

Browse Source 
Latent bug surfaced by iter38 multi-device probe. profiles[] array
in RequestQueryConfigProfiles is sized by V4L2_REQUEST_MAX_PROFILES
(set as context->max_profiles=11 in VA_DRIVER_INIT), but the bounds
checks used V4L2_REQUEST_MAX_CONFIG_ATTRIBUTES (10). Pre-iter38 only
a single device's profiles were enumerated, total ≤9, so the off-by-
one never bit. With iter38's rkvdec+hantro union (10 profiles total
across MPEG2/H264/HEVC/VP8/VP9), the last enumerator (VP9) hit
index=9 with the check 'index < 10-1 = 9' → skipped.
This commit is contained in:
Claude (noether)
2026-05-14 18:55:27 +00:00
parent c56a77bd4c
commit 7ac934e0c5
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/config.c
+5 -5
View File
@@ -181,13 +181,13 @@ VAStatus RequestQueryConfigProfiles(VADriverContextP context,
bool found; bool found;
found = any_fd_supports_output_format(driver_data, V4L2_PIX_FMT_MPEG2_SLICE); found = any_fd_supports_output_format(driver_data, V4L2_PIX_FMT_MPEG2_SLICE);
if (found && index < (V4L2_REQUEST_MAX_CONFIG_ATTRIBUTES - 2)) { if (found && index < (V4L2_REQUEST_MAX_PROFILES - 2)) {
profiles[index++] = VAProfileMPEG2Simple; profiles[index++] = VAProfileMPEG2Simple;
profiles[index++] = VAProfileMPEG2Main; profiles[index++] = VAProfileMPEG2Main;
} }
found = any_fd_supports_output_format(driver_data, V4L2_PIX_FMT_H264_SLICE); found = any_fd_supports_output_format(driver_data, V4L2_PIX_FMT_H264_SLICE);
if (found && index < (V4L2_REQUEST_MAX_CONFIG_ATTRIBUTES - 5)) { if (found && index < (V4L2_REQUEST_MAX_PROFILES - 5)) {
profiles[index++] = VAProfileH264Main; profiles[index++] = VAProfileH264Main;
profiles[index++] = VAProfileH264High; profiles[index++] = VAProfileH264High;
profiles[index++] = VAProfileH264ConstrainedBaseline; profiles[index++] = VAProfileH264ConstrainedBaseline;
@@ -196,15 +196,15 @@ VAStatus RequestQueryConfigProfiles(VADriverContextP context,
} }
found = any_fd_supports_output_format(driver_data, V4L2_PIX_FMT_HEVC_SLICE); found = any_fd_supports_output_format(driver_data, V4L2_PIX_FMT_HEVC_SLICE);
if (found && index < (V4L2_REQUEST_MAX_CONFIG_ATTRIBUTES - 1)) if (found && index < (V4L2_REQUEST_MAX_PROFILES - 1))
profiles[index++] = VAProfileHEVCMain; profiles[index++] = VAProfileHEVCMain;
found = any_fd_supports_output_format(driver_data, V4L2_PIX_FMT_VP8_FRAME); found = any_fd_supports_output_format(driver_data, V4L2_PIX_FMT_VP8_FRAME);
if (found && index < (V4L2_REQUEST_MAX_CONFIG_ATTRIBUTES - 1)) if (found && index < (V4L2_REQUEST_MAX_PROFILES - 1))
profiles[index++] = VAProfileVP8Version0_3; profiles[index++] = VAProfileVP8Version0_3;
found = any_fd_supports_output_format(driver_data, V4L2_PIX_FMT_VP9_FRAME); found = any_fd_supports_output_format(driver_data, V4L2_PIX_FMT_VP9_FRAME);
if (found && index < (V4L2_REQUEST_MAX_CONFIG_ATTRIBUTES - 1)) if (found && index < (V4L2_REQUEST_MAX_PROFILES - 1))
profiles[index++] = VAProfileVP9Profile0; profiles[index++] = VAProfileVP9Profile0;
*profiles_count = index; *profiles_count = index;