libcamera: camera: Ensure a request's controls are valid

The list of controls part of a Request is initialized with the
ControlInfoMap of the Camera the Request is created from.

Applications can re-assign the controls list in a Request
which could cause issues during serialization.

Validate that the ControlList in a Request is valid when
the Request is queued to the Camera by inspecting the
ControlInfoMap pointer.

Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Reviewed-by: Barnabás Pőcze <barnabas.pocze@ideasonboard.com>

src/libcamera/camera.cpp

@@ -1345,6 +1345,12 @@ int Camera::queueRequest(Request *request)
 		return -EINVAL;
 	}
 
+	/* Make sure the Request has a valid control list. */
+	if (request->controls().infoMap() != &controls()) {
+		LOG(Camera, Error) << "Overwriting Request::controls() is not allowed";
+		return -EINVAL;
+	}
+
 	/*
 	 * The camera state may change until the end of the function. No locking
 	 * is however needed as PipelineHandler::queueRequest() will handle