From aded70333df3093bbbc34342b227feef7b90aea9 Mon Sep 17 00:00:00 2001 From: Martin Pulec Date: Thu, 17 Jun 2021 16:09:19 +0200 Subject: [PATCH] VRG: safety checks - padding & width<=pitch Check if we have sufficient padding (currently 2048) or it needs to be extended. Drop wrong render packets with width>pitch (runtime sometime generates such). --- src/video_display/vrg.cpp | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/src/video_display/vrg.cpp b/src/video_display/vrg.cpp index ddb36508c..ef3086caf 100644 --- a/src/video_display/vrg.cpp +++ b/src/video_display/vrg.cpp @@ -75,6 +75,8 @@ #include #endif +constexpr int PADDING = 2048; + using std::chrono::duration_cast; using std::chrono::high_resolution_clock; using std::chrono::microseconds; @@ -255,11 +257,17 @@ static void display_vrg_run(void *state) double seconds = duration_cast(render_frame_end - render_frame_start).count() / 1000000.0; LOG(LOG_LEVEL_DEBUG) << MOD_NAME "Received RenderPacket for frame " << render_packet.frame << ": " << render_packet << ", dur: " << seconds << " s.\n"; if (render_packet.pix_width_eye > 0 && render_packet.pix_height_eye > 0 && - render_packet.pix_width_eye <= 7680 && render_packet.pix_height_eye <= 4320) { + render_packet.pix_width_eye <= 7680 && render_packet.pix_height_eye <= 4320 && + 2U * render_packet.pix_width_eye <= render_packet.dx_row_pitch && (unsigned) render_packet.pix_width_eye <= render_packet.dx_row_pitch_uv) { + if (render_packet.dx_row_pitch > render_packet.pix_width_eye * 2U + PADDING || + render_packet.dx_row_pitch_uv > render_packet.pix_width_eye + PADDING / 2U) { + LOG(LOG_LEVEL_ERROR) << MOD_NAME "Insufficient padding " << PADDING << " for " << render_packet << ". Fix in code!\n"; + abort(); + } s->render_packet_ts.emplace(render_packet.frame, high_resolution_clock::now()); rtp_send_rtcp_app(s->rtp, "VIEW", sizeof render_packet, (char *) &render_packet); } else { - LOG(LOG_LEVEL_ERROR) << MOD_NAME "Wrong RenderPacket dimensions: " << render_packet << "\n"; + LOG(LOG_LEVEL_ERROR) << MOD_NAME "Wrong RenderPacket (dimensions or width>pitch): " << render_packet << "\n"; } } @@ -398,7 +406,7 @@ static int display_vrg_reconfigure(void *state, struct video_desc desc) } #endif // use headroom - VRG uses pitches - s->pool.reconfigure(desc, vc_get_datalen(desc.width + 2048, desc.height, desc.color_spec)); + s->pool.reconfigure(desc, vc_get_datalen(desc.width + PADDING, desc.height, desc.color_spec)); return TRUE; }