1086596 - [B2G][Camera] Get boolean camera parameter crashes if missing

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Gaia::Camera, defect)

Description

[Andrew Osmond [:aosmond] (he/him)]

No STR but noticed this while testing that if GonkCameraParameters::Get is used for a boolean parameter not set by the camera driver or application, then the process will crash with the following signature:

Core was generated by `/system/b2g/plugin-container -greomni /system/b2g/omni.ja -appdir /system/b2g 3'.
Program terminated with signal 11, Segmentation fault.
(gdb) bt
#0  strcmp () at bionic/libc/arch-arm/krait/bionic/strcmp.S:396
#1  0xb5253cc4 in get (aRet=@0xb05e1c0f: 176, aKey=0xfffffd4c <Address 0xfffffd4c out of bounds>, this=0x0) at ../../../../b2g-inbound/dom/camera/GonkCameraParameters.h:128
#2  mozilla::GonkCameraParameters::GetImpl<bool> (this=0xffffffff, aKey=<optimized out>, aValue=@0xb05e1c0f: 176) at ../../../../b2g-inbound/dom/camera/GonkCameraParameters.h:162

Comment 1

[Andrew Osmond [:aosmond] (he/him)]

Attachment: bug1086596.patch, v1

Comment 2

[Mike Habicher [:mikeh] (high bugzilla latency)]

Comment on attachment 8508735 [details] [diff] [review]
bug1086596.patch, v1

Review of attachment 8508735 [details] [diff] [review]:
-----------------------------------------------------------------

r+ with extreme prejudice.

::: dom/camera/GonkCameraParameters.cpp
@@ +351,5 @@
>  {
>    if (aSize.width > INT_MAX || aSize.height > INT_MAX) {
>      // AOSP can only handle signed ints.
>      DOM_CAMERA_LOGE("Camera parameter aKey=%d out of bounds (width=%u, height=%u)\n",
> +      aKey, aSize.width, aSize.height);

/facepalm. Good catch.

::: dom/camera/GonkCameraParameters.h
@@ +125,5 @@
> +    void
> +    get(const char* aKey, bool& aRet)
> +    {
> +      const char* value = get(aKey);
> +      aRet = value ? strcmp(value, FALSE) : false;

Oh strcmp(). Please make this:
  aRet = value ? strcmp(value, TRUE) == 0 : false;

Comment 3

[Andrew Osmond [:aosmond] (he/him)]

Attachment: bug1086596.patch, v2 [r=mikeh]

try: https://treeherder.mozilla.org/ui/#/jobs?repo=try&revision=2ff184121920

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/b2g-inbound/rev/ac81f05436fa

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/ac81f05436fa