Skip to content

v4l2_codec2: encode: fix crash when input.buffers[0] is nullptr

The client can crash the V4L2EncodeComponent by passing passing an input with one buffer where buffer==nullptr:

F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
F DEBUG   : Build fingerprint: 'TI/am62p/am62p:14/UQ1A.240105.002/eng.mkorpe.20240325.115051:userdebug/test-keys'
F DEBUG   : Revision: '0'
F DEBUG   : ABI: 'arm64'
F DEBUG   : Timestamp: 2024-04-09 07:53:02.494446645+0000
F DEBUG   : Process uptime: 8s
F DEBUG   : Cmdline: /vendor/bin/hw/android.hardware.media.c2@1.0-service-v4l2
F DEBUG   : pid: 4949, tid: 4955, name: V4L2EncodeCompo  >>> /vendor/bin/hw/android.hardware.media.c2@1.0-service-v4l2 <<<
F DEBUG   : uid: 1013
F DEBUG   : tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
F DEBUG   : signal 0 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr --------
F DEBUG   : Cause: null pointer dereference
F DEBUG   :     x0  0000000000000000  x1  b400007acbed72e8  x2  b400007a3beda7f0  x3  0000000000000010
F DEBUG   :     x4  020000797bedb2c0  x5  b400007a2bed1878  x6  0000000000000001  x7  7f7f7f7f7f7fff7f
F DEBUG   :     x8  00000078e68d0710  x9  b40000795bed9990  x10 b40000795bed99a0  x11 0000000000000003
F DEBUG   :     x12 0000000000000000  x13 0000000000000004  x14 0000000000000276  x15 0000000000000000
F DEBUG   :     x16 0000007b7c1eac60  x17 0000007b80a6c770  x18 00000078e5aa2000  x19 b400007a0bede5a0
F DEBUG   :     x20 00000078e68d07e0  x21 0000000000000000  x22 0000000000000000  x23 b400007a9bed6210
F DEBUG   :     x24 0000000000000000  x25 00000078e68d1000  x26 0000000000000002  x27 0000007b8a387b88
F DEBUG   :     x28 00000000000fc000  x29 00000078e68d0680
F DEBUG   :     lr  0000007b7c1cbb20  sp  00000078e68d0680  pc  0000007b80a6c778  pst 0000000080000000
F DEBUG   : 12 total frames
F DEBUG   : backtrace:
F DEBUG   :       #00 pc 0000000000069778  /vendor/lib64/libcodec2_vndk.so (C2Buffer::data() const+8) (BuildId: 1d42f8105aac0515945328329706c2e1)
F DEBUG   :       #01 pc 0000000000042b1c  /vendor/lib64/libv4l2_codec2_components.so (android::V4L2EncodeComponent::queueTask(std::__1::unique_ptr<C2Work, std::__1::default_delete<C2Work> >)+348) (BuildId: 2f6128320f05c503e8ee6dc9e05df980)
F DEBUG   :       #02 pc 00000000000470a8  /vendor/lib64/libv4l2_codec2_components.so (base::internal::Invoker<base::internal::BindState<void (android::V4L2EncodeComponent::*)(std::__1::unique_ptr<C2Work, std::__1::default_delete<C2Work> >), base::WeakPtr<android::V4L2EncodeComponent>, std::__1::unique_ptr<C2Work, std::__1::default_delete<C2Work> > >, void ()>::RunOnce(base::internal::BindStateBase*)+120) (BuildId: 2f6128320f05c503e8ee6dc9e05df980)
F DEBUG   :       #03 pc 00000000000acca0  /vendor/lib64/libchrome.so (base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)+192) (BuildId: 87e214635dddac0ae594ee401576361a)
F DEBUG   :       #04 pc 00000000000cc9ac  /vendor/lib64/libchrome.so (base::MessageLoop::RunTask(base::PendingTask*)+348) (BuildId: 87e214635dddac0ae594ee401576361a)
F DEBUG   :       #05 pc 00000000000ccd84  /vendor/lib64/libchrome.so (base::MessageLoop::DoWork()+468) (BuildId: 87e214635dddac0ae594ee401576361a)
F DEBUG   :       #06 pc 00000000000ce080  /vendor/lib64/libchrome.so (base::MessagePumpDefault::Run(base::MessagePump::Delegate*)+96) (BuildId: 87e214635dddac0ae594ee401576361a)
F DEBUG   :       #07 pc 00000000000f1fec  /vendor/lib64/libchrome.so (base::RunLoop::Run()+60) (BuildId: 87e214635dddac0ae594ee401576361a)
F DEBUG   :       #08 pc 0000000000111e88  /vendor/lib64/libchrome.so (base::Thread::ThreadMain()+392) (BuildId: 87e214635dddac0ae594ee401576361a)
F DEBUG   :       #09 pc 000000000010f040  /vendor/lib64/libchrome.so (base::(anonymous namespace)::ThreadFunc(void*)+128) (BuildId: 87e214635dddac0ae594ee401576361a)
F DEBUG   :       #10 pc 00000000000d6fb0  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+208) (BuildId: 218db69eb66aeb253a34d956906a8bba)
F DEBUG   :       #11 pc 000000000006ad90  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: 218db69eb66aeb253a34d956906a8bba)

This is tested by VtsHalMediaC2V1_0TargetComponentTest#testInputBuffer().

Fix this by guarding against this condition, as done in SimpleC2Component[1]

[1] https://android.googlesource.com/platform/frameworks/av/+/refs/heads/main/media/codec2/components/base/SimpleC2Component.cpp#1141 Test: atest VtsHalMediaC2V1_0TargetComponentTest Change-Id: I407f8f7fb420bd993a665c0a7cb10ad1e224d0fb Signed-off-by: Mattijs Korpershoek mkorpershoek@baylibre.com

Merge request reports

Loading