From 310cd8bc0756717cde97fe5b083926f6d6931f58 Mon Sep 17 00:00:00 2001 From: Jacopo Mondi Date: Tue, 2 Dec 2025 15:17:15 +0100 Subject: [PATCH] libcamera: camera: Ensure a request's controls are valid MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The list of controls part of a Request is initialized with the ControlInfoMap of the Camera the Request is created from. Applications can re-assign the controls list in a Request which could cause issues during serialization. Validate that the ControlList in a Request is valid when the Request is queued to the Camera by inspecting the ControlInfoMap pointer. Signed-off-by: Jacopo Mondi Reviewed-by: Daniel Scally Reviewed-by: Barnabás Pőcze --- src/libcamera/camera.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/libcamera/camera.cpp b/src/libcamera/camera.cpp index 2e1e146a..7c0e93ff 100644 --- a/src/libcamera/camera.cpp +++ b/src/libcamera/camera.cpp @@ -1345,6 +1345,12 @@ int Camera::queueRequest(Request *request) return -EINVAL; } + /* Make sure the Request has a valid control list. */ + if (request->controls().infoMap() != &controls()) { + LOG(Camera, Error) << "Overwriting Request::controls() is not allowed"; + return -EINVAL; + } + /* * The camera state may change until the end of the function. No locking * is however needed as PipelineHandler::queueRequest() will handle