8 个文件变更+66-14
Mframeworks/native/camera/base/src/input/camera_manager.cpp+46-7
@@ -1957,24 +1957,33 @@ void CameraManager::ParsingCameraConcurrentLimted(camera_metadata_item_t &item,
1957 cameraDevNow->limtedCapabilitySave_.colorspaces.modeInfo.clear();1957 cameraDevNow->limtedCapabilitySave_.colorspaces.modeInfo.clear();
1958 for (int32_t i = 0; i < static_cast<int32_t>(count);) {1958 for (int32_t i = 0; i < static_cast<int32_t>(count);) {
1959 if (static_cast<camera_device_metadata_tag>(originInfo[i]) == OHOS_ABILITY_FLASH_MODES) {1959 if (static_cast<camera_device_metadata_tag>(originInfo[i]) == OHOS_ABILITY_FLASH_MODES) {
1960- std::vector<int32_t>vec;1960+ CHECK_BREAK_WLOG(i + STEP_ONE >= static_cast<int32_t>(count), "brk1");
1961 int length = static_cast<int32_t>(originInfo[i + STEP_ONE]);1961 int length = static_cast<int32_t>(originInfo[i + STEP_ONE]);
1962+ CHECK_BREAK_WLOG(
1963+ length < 0 || static_cast<int64_t>(i) + STEP_TWO + length > static_cast<int64_t>(count), "brk2");
1964+ std::vector<int32_t> vec;
1962 cameraDevNow->limtedCapabilitySave_.flashmodes.count = length;1965 cameraDevNow->limtedCapabilitySave_.flashmodes.count = length;
1963 GetAbilityStructofConcurrentLimted(vec, originInfo + i + STEP_TWO, length);1966 GetAbilityStructofConcurrentLimted(vec, originInfo + i + STEP_TWO, length);
1964 cameraDevNow->limtedCapabilitySave_.flashmodes.mode = vec;1967 cameraDevNow->limtedCapabilitySave_.flashmodes.mode = vec;
1965 i = i + length + STEP_TWO + STEP_ONE;1968 i = i + length + STEP_TWO + STEP_ONE;
1966 } else if (static_cast<camera_device_metadata_tag>(originInfo[i]) == OHOS_ABILITY_EXPOSURE_MODES) {1969 } else if (static_cast<camera_device_metadata_tag>(originInfo[i]) == OHOS_ABILITY_EXPOSURE_MODES) {
1967- std::vector<int32_t>vec;1970+ CHECK_BREAK_WLOG(i + STEP_ONE >= static_cast<int32_t>(count), "brk3");
1968 int length = static_cast<int32_t>(originInfo[i + STEP_ONE]);1971 int length = static_cast<int32_t>(originInfo[i + STEP_ONE]);
1972+ CHECK_BREAK_WLOG(
1973+ length < 0 || static_cast<int64_t>(i) + STEP_TWO + length > static_cast<int64_t>(count), "brk4");
1974+ std::vector<int32_t> vec;
1969 cameraDevNow->limtedCapabilitySave_.exposuremodes.count = length;1975 cameraDevNow->limtedCapabilitySave_.exposuremodes.count = length;
1970 GetAbilityStructofConcurrentLimted(vec, originInfo + i + STEP_TWO, length);1976 GetAbilityStructofConcurrentLimted(vec, originInfo + i + STEP_TWO, length);
1971 cameraDevNow->limtedCapabilitySave_.exposuremodes.mode = vec;1977 cameraDevNow->limtedCapabilitySave_.exposuremodes.mode = vec;
1972 i = i + length + STEP_TWO + STEP_ONE;1978 i = i + length + STEP_TWO + STEP_ONE;
1973 } else if (static_cast<camera_device_metadata_tag>(originInfo[i]) == OHOS_ABILITY_ZOOM_RATIO_RANGE) {1979 } else if (static_cast<camera_device_metadata_tag>(originInfo[i]) == OHOS_ABILITY_ZOOM_RATIO_RANGE) {
1974- std::vector<float>vec;1980+ CHECK_BREAK_WLOG(i + STEP_ONE >= static_cast<int32_t>(count), "brk5");
1975 int length = static_cast<int32_t>(originInfo[i + STEP_ONE]);1981 int length = static_cast<int32_t>(originInfo[i + STEP_ONE]);
1982+ CHECK_BREAK_WLOG(length < 0, "brk6");
1983+ std::vector<float> vec;
1976 cameraDevNow->limtedCapabilitySave_.ratiorange.count = length / STEP_THREE;1984 cameraDevNow->limtedCapabilitySave_.ratiorange.count = length / STEP_THREE;
1977 for (int j = i + STEP_TWO; j < i + length + STEP_TWO + STEP_ONE; j += STEP_THREE) {1985 for (int j = i + STEP_TWO; j < i + length + STEP_TWO + STEP_ONE; j += STEP_THREE) {
1986+ CHECK_BREAK_WLOG(j + STEP_TWO >= static_cast<int32_t>(count), "brk7");
1978 cameraDevNow->limtedCapabilitySave_.ratiorange.mode.push_back(static_cast<int32_t>(originInfo[j]));1987 cameraDevNow->limtedCapabilitySave_.ratiorange.mode.push_back(static_cast<int32_t>(originInfo[j]));
1979 cameraDevNow->limtedCapabilitySave_.ratiorange.range.insert({static_cast<int32_t>(originInfo[j]),1988 cameraDevNow->limtedCapabilitySave_.ratiorange.range.insert({static_cast<int32_t>(originInfo[j]),
1980 make_pair(static_cast<float>(originInfo[j + STEP_ONE]),1989 make_pair(static_cast<float>(originInfo[j + STEP_ONE]),
@@ -1982,22 +1991,31 @@ void CameraManager::ParsingCameraConcurrentLimted(camera_metadata_item_t &item,
1982 }1991 }
1983 i = i + length + STEP_TWO + STEP_ONE;1992 i = i + length + STEP_TWO + STEP_ONE;
1984 } else if (static_cast<camera_device_metadata_tag>(originInfo[i]) == OHOS_ABILITY_AE_COMPENSATION_RANGE) {1993 } else if (static_cast<camera_device_metadata_tag>(originInfo[i]) == OHOS_ABILITY_AE_COMPENSATION_RANGE) {
1985- std::vector<float>vec;1994+ CHECK_BREAK_WLOG(i + STEP_ONE >= static_cast<int32_t>(count), "brk8");
1986 int length = static_cast<int32_t>(originInfo[i + STEP_ONE]);1995 int length = static_cast<int32_t>(originInfo[i + STEP_ONE]);
1996+ CHECK_BREAK_WLOG(
1997+ length < 0 || static_cast<int64_t>(i) + STEP_TWO + length > static_cast<int64_t>(count), "brk9");
1998+ std::vector<float> vec;
1987 cameraDevNow->limtedCapabilitySave_.compensation.count = length;1999 cameraDevNow->limtedCapabilitySave_.compensation.count = length;
1988 GetAbilityStructofConcurrentLimtedfloat(vec, originInfo + i + STEP_TWO, length);2000 GetAbilityStructofConcurrentLimtedfloat(vec, originInfo + i + STEP_TWO, length);
1989 cameraDevNow->limtedCapabilitySave_.compensation.range = vec;2001 cameraDevNow->limtedCapabilitySave_.compensation.range = vec;
1990 i = i + length + STEP_TWO + STEP_ONE;2002 i = i + length + STEP_TWO + STEP_ONE;
1991 } else if (static_cast<camera_device_metadata_tag>(originInfo[i]) == OHOS_ABILITY_FOCUS_MODES) {2003 } else if (static_cast<camera_device_metadata_tag>(originInfo[i]) == OHOS_ABILITY_FOCUS_MODES) {
1992- std::vector<int32_t>vec;2004+ CHECK_BREAK_WLOG(i + STEP_ONE >= static_cast<int32_t>(count), "brk10");
1993 int length = static_cast<int32_t>(originInfo[i + STEP_ONE]);2005 int length = static_cast<int32_t>(originInfo[i + STEP_ONE]);
2006+ CHECK_BREAK_WLOG(
2007+ length < 0 || static_cast<int64_t>(i) + STEP_TWO + length > static_cast<int64_t>(count), "brk11");
2008+ std::vector<int32_t> vec;
1994 cameraDevNow->limtedCapabilitySave_.focusmodes.count = length;2009 cameraDevNow->limtedCapabilitySave_.focusmodes.count = length;
1995 GetAbilityStructofConcurrentLimted(vec, originInfo + i + STEP_TWO, length);2010 GetAbilityStructofConcurrentLimted(vec, originInfo + i + STEP_TWO, length);
1996 cameraDevNow->limtedCapabilitySave_.focusmodes.mode = vec;2011 cameraDevNow->limtedCapabilitySave_.focusmodes.mode = vec;
1997 i = i + length + STEP_TWO + STEP_ONE;2012 i = i + length + STEP_TWO + STEP_ONE;
1998 } else if (static_cast<camera_device_metadata_tag>(originInfo[i]) == OHOS_ABILITY_VIDEO_STABILIZATION_MODES) {2013 } else if (static_cast<camera_device_metadata_tag>(originInfo[i]) == OHOS_ABILITY_VIDEO_STABILIZATION_MODES) {
1999- std::vector<int32_t>vec;2014+ CHECK_BREAK_WLOG(i + STEP_ONE >= static_cast<int32_t>(count), "brk12");
2000 int length = static_cast<int32_t>(originInfo[i + STEP_ONE]);2015 int length = static_cast<int32_t>(originInfo[i + STEP_ONE]);
2016+ CHECK_BREAK_WLOG(
2017+ length < 0 || static_cast<int64_t>(i) + STEP_TWO + length > static_cast<int64_t>(count), "brk13");
2018+ std::vector<int32_t> vec;
2001 cameraDevNow->limtedCapabilitySave_.stabilizationmodes.count = length;2019 cameraDevNow->limtedCapabilitySave_.stabilizationmodes.count = length;
2002 GetAbilityStructofConcurrentLimted(vec, originInfo + i + STEP_TWO, length);2020 GetAbilityStructofConcurrentLimted(vec, originInfo + i + STEP_TWO, length);
2003 cameraDevNow->limtedCapabilitySave_.stabilizationmodes.mode = vec;2021 cameraDevNow->limtedCapabilitySave_.stabilizationmodes.mode = vec;
@@ -3078,7 +3096,9 @@ sptr<CameraOutputCapability> CameraManager::GetSupportedOutputCapability(sptr<Ca
3078 FillSupportPreviewFormats(curPreviewProfiles));3096 FillSupportPreviewFormats(curPreviewProfiles));
3079 cameraOutputCapability->SetPreviewProfiles(curPreviewProfiles);3097 cameraOutputCapability->SetPreviewProfiles(curPreviewProfiles);
3080 if (!isPhotoMode_.count(modeName)) {3098 if (!isPhotoMode_.count(modeName)) {
3081- cameraOutputCapability->SetVideoProfiles(camera->modeVideoProfiles_[modeName]);3099+ std::vector<VideoProfile> curVideoProfiles = camera->modeVideoProfiles_[modeName];
3100+ RemoveExtendedVideoFrameRates(curVideoProfiles, completeRemove);
3101+ cameraOutputCapability->SetVideoProfiles(curVideoProfiles);
3082 }3102 }
3083 cameraOutputCapability->SetDepthProfiles(camera->modeDepthProfiles_[modeName]);3103 cameraOutputCapability->SetDepthProfiles(camera->modeDepthProfiles_[modeName]);
3084 3104 
@@ -3114,6 +3134,25 @@ sptr<CameraOutputCapability> CameraManager::GetSupportedFullOutputCapability(spt
3114#endif3134#endif
3115}3135}
3116 3136 
3137+void CameraManager::RemoveExtendedVideoFrameRates(std::vector<VideoProfile>& videoProfiles, bool completeRemove)
3138+{
3139+ CHECK_RETURN(!completeRemove || videoProfiles.size() == 0);
3140+ std::vector<VideoProfile> preservedProfiles = {};
3141+ for (const auto& profile : videoProfiles) {
3142+ bool has50fps = false;
3143+ for (const auto& framerate : profile.framerates_) {
3144+ if (framerate == MAX_FPS_50) {
3145+ has50fps = true;
3146+ break;
3147+ }
3148+ }
3149+ if (!has50fps) {
3150+ preservedProfiles.push_back(profile);
3151+ }
3152+ }
3153+ videoProfiles = preservedProfiles;
3154+}
3155+ 
3117sptr<CameraOutputCapability> CameraManager::ParseSupportedOutputCapability(sptr<CameraDevice>& camera, int32_t modeName,3156sptr<CameraOutputCapability> CameraManager::ParseSupportedOutputCapability(sptr<CameraDevice>& camera, int32_t modeName,
3118 std::shared_ptr<OHOS::Camera::CameraMetadata> cameraAbility)3157 std::shared_ptr<OHOS::Camera::CameraMetadata> cameraAbility)
3119{3158{
Mframeworks/native/camera/base/src/output/photo_output.cpp+6-5
@@ -1175,15 +1175,16 @@ int32_t PhotoOutput::IsAutoHighQualityPhotoSupported(int32_t &isAutoHighQualityP
1175 std::shared_ptr<Camera::CameraMetadata> metadata = cameraObj->GetCachedMetadata();1175 std::shared_ptr<Camera::CameraMetadata> metadata = cameraObj->GetCachedMetadata();
1176 CHECK_RETURN_RET(metadata == nullptr, SESSION_NOT_RUNNING);1176 CHECK_RETURN_RET(metadata == nullptr, SESSION_NOT_RUNNING);
1177 int32_t ret = Camera::FindCameraMetadataItem(metadata->get(), OHOS_ABILITY_HIGH_QUALITY_SUPPORT, &item);1177 int32_t ret = Camera::FindCameraMetadataItem(metadata->get(), OHOS_ABILITY_HIGH_QUALITY_SUPPORT, &item);
1178- if (ret == CAM_META_SUCCESS) {1178+ if (ret == CAM_META_SUCCESS && item.count >= 2) {
1179 isAutoHighQualityPhotoSupported = (item.data.u8[1] == 1) ? 0 : -1; // default mode1179 isAutoHighQualityPhotoSupported = (item.data.u8[1] == 1) ? 0 : -1; // default mode
1180 }1180 }
1181- 
1182 int headLenPerMode = 2;1181 int headLenPerMode = 2;
1183 SceneMode currentSceneMode = session->GetMode();1182 SceneMode currentSceneMode = session->GetMode();
1184- for (int i = 0; i < static_cast<int>(item.count); i += headLenPerMode) {1183+ if (ret == CAM_META_SUCCESS) {
1185- if (currentSceneMode == static_cast<int>(item.data.u8[i])) {1184+ for (int i = 0; i + 1 < static_cast<int>(item.count); i += headLenPerMode) {
1186- isAutoHighQualityPhotoSupported = (item.data.u8[i + 1] == 1) ? 0 : -1;1185+ if (currentSceneMode == static_cast<int>(item.data.u8[i])) {
1186+ isAutoHighQualityPhotoSupported = (item.data.u8[i + 1] == 1) ? 0 : -1;
1187+ }
1187 }1188 }
1188 }1189 }
1189 MEDIA_INFO_LOG("PhotoOutput IsAutoHighQualityPhotoSupported curMode:%{public}d, modeSupportType:%{public}d",1190 MEDIA_INFO_LOG("PhotoOutput IsAutoHighQualityPhotoSupported curMode:%{public}d, modeSupportType:%{public}d",
Mframeworks/native/camera/base/src/output/sketch_wrapper.cpp+3-0
@@ -478,6 +478,9 @@ void SketchWrapper::UpdateSketchConfigFromMoonCaptureBoostConfig(
478 continue;478 continue;
479 }479 }
480 SketchReferenceFovRange fovRange;480 SketchReferenceFovRange fovRange;
481+ if (i + 2 >= item.count) {
482+ break;
483+ }
481 fovRange.zoomMin = static_cast<float>(item.data.ui32[i]) / SKETCH_DIV;484 fovRange.zoomMin = static_cast<float>(item.data.ui32[i]) / SKETCH_DIV;
482 fovRange.zoomMax = static_cast<float>(item.data.ui32[i + 1]) / SKETCH_DIV; // Offset 1 data485 fovRange.zoomMax = static_cast<float>(item.data.ui32[i + 1]) / SKETCH_DIV; // Offset 1 data
483 fovRange.referenceValue = static_cast<float>(item.data.ui32[i + 2]) / SKETCH_DIV; // Offset 2 data486 fovRange.referenceValue = static_cast<float>(item.data.ui32[i + 2]) / SKETCH_DIV; // Offset 2 data
Mframeworks/native/camera/base/src/session/capture_session.cpp+2-0
@@ -3855,6 +3855,8 @@ int32_t CaptureSession::GetZoomRatioRange(std::vector<float>& zoomRatioRange)
3855 uint32_t minOffset = 1;3855 uint32_t minOffset = 1;
3856 uint32_t maxOffset = 2;3856 uint32_t maxOffset = 2;
3857 for (uint32_t i = 0; i < item.count; i += step) {3857 for (uint32_t i = 0; i < item.count; i += step) {
3858+ CHECK_BREAK_ELOG(i + maxOffset >= item.count,
3859+ "CaptureSession::GetZoomRatioRange: invalid data format");
3858 MEDIA_INFO_LOG("Scene zoom cap mode: %{public}d, min: %{public}d, max: %{public}d", item.data.i32[i],3860 MEDIA_INFO_LOG("Scene zoom cap mode: %{public}d, min: %{public}d, max: %{public}d", item.data.i32[i],
3859 item.data.i32[i + minOffset], item.data.i32[i + maxOffset]);3861 item.data.i32[i + minOffset], item.data.i32[i + maxOffset]);
3860 if (GetFeaturesMode().GetFeaturedMode() == item.data.i32[i]) {3862 if (GetFeaturesMode().GetFeaturedMode() == item.data.i32[i]) {
Mframeworks/native/camera/base/src/session/features/moon_capture_boost_feature.cpp+3-0
@@ -53,6 +53,9 @@ MoonCaptureBoostFeature::MoonCaptureBoostFeature(
53 continue;53 continue;
54 }54 }
55 SketchReferenceFovRange fovRange;55 SketchReferenceFovRange fovRange;
56+ if (i + 2 >= item.count) {
57+ break;
58+ }
56 fovRange.zoomMin = static_cast<float>(item.data.ui32[i]) / SKETCH_DIV;59 fovRange.zoomMin = static_cast<float>(item.data.ui32[i]) / SKETCH_DIV;
57 fovRange.zoomMax = static_cast<float>(item.data.ui32[i + 1]) / SKETCH_DIV; // Offset 1 data60 fovRange.zoomMax = static_cast<float>(item.data.ui32[i + 1]) / SKETCH_DIV; // Offset 1 data
58 fovRange.referenceValue = static_cast<float>(item.data.ui32[i + 2]) / SKETCH_DIV; // Offset 2 data61 fovRange.referenceValue = static_cast<float>(item.data.ui32[i + 2]) / SKETCH_DIV; // Offset 2 data
Minterfaces/inner_api/native/camera/include/ability/camera_ability_parse_util.h+1-1
@@ -89,7 +89,7 @@ const int32_t STEP_TWO = 2;
89const int32_t STEP_THREE = 3;89const int32_t STEP_THREE = 3;
90const int32_t STEP_FOUR = 4;90const int32_t STEP_FOUR = 4;
91const int32_t STEP_NINE = 9;91const int32_t STEP_NINE = 9;
92- 92+constexpr int32_t MAX_FPS_50 = 50;
93class CameraAbilityParseUtil {93class CameraAbilityParseUtil {
94public:94public:
95 static void GetModeInfo(95 static void GetModeInfo(
Minterfaces/inner_api/native/camera/include/input/camera_manager.h+1-0
@@ -1230,6 +1230,7 @@ private:
1230 void RemoveExtendedSupportPhotoFormats(std::vector<Profile>& photoProfiles, bool completeRemove = true);1230 void RemoveExtendedSupportPhotoFormats(std::vector<Profile>& photoProfiles, bool completeRemove = true);
1231#endif1231#endif
1232 void FillSupportPreviewFormats(std::vector<Profile>& previewProfiles);1232 void FillSupportPreviewFormats(std::vector<Profile>& previewProfiles);
1233+ void RemoveExtendedVideoFrameRates(std::vector<VideoProfile>& videoProfiles, bool completeRemove = true);
1233 inline void SetServiceProxy(sptr<ICameraService> proxy)1234 inline void SetServiceProxy(sptr<ICameraService> proxy)
1234 {1235 {
1235 std::lock_guard<std::mutex> lock(serviceProxyMutex_);1236 std::lock_guard<std::mutex> lock(serviceProxyMutex_);
Mservices/camera_service/src/hcapture_session.cpp+4-1
@@ -2006,10 +2006,13 @@ bool HCaptureSession::QueryZoomPerformance(
2006 static_cast<OHOS::HDI::Camera::V1_3::OperationMode>(operationMode),2006 static_cast<OHOS::HDI::Camera::V1_3::OperationMode>(operationMode),
2007 GetSessionId());2007 GetSessionId());
2008 for (int i = 0; i < static_cast<int>(zoomItem.count);) {2008 for (int i = 0; i < static_cast<int>(zoomItem.count);) {
2009+ CHECK_BREAK_WLOG(i + 1 >= static_cast<int>(zoomItem.count), "brk1");
2009 int sceneMode = static_cast<int>(zoomItem.data.ui32[i]);2010 int sceneMode = static_cast<int>(zoomItem.data.ui32[i]);
2010 int zoomPointsNum = static_cast<int>(zoomItem.data.ui32[i + 1]);2011 int zoomPointsNum = static_cast<int>(zoomItem.data.ui32[i + 1]);
2012+ CHECK_BREAK_WLOG(zoomPointsNum < 0, "brk2");
2011 if (static_cast<OHOS::HDI::Camera::V1_3::OperationMode>(operationMode) == sceneMode) {2013 if (static_cast<OHOS::HDI::Camera::V1_3::OperationMode>(operationMode) == sceneMode) {
2012 for (int j = 0; j < dataLenPerPoint * zoomPointsNum; j++) {2014 for (int j = 0; j < dataLenPerPoint * zoomPointsNum; j++) {
2015+ CHECK_BREAK_WLOG(i + headLenPerMode + j >= static_cast<int>(zoomItem.count), "brk3");
2013 crossZoomAndTime.push_back(zoomItem.data.ui32[i + headLenPerMode + j]);2016 crossZoomAndTime.push_back(zoomItem.data.ui32[i + headLenPerMode + j]);
2014 MEDIA_DEBUG_LOG("HCaptureSession::QueryZoomPerformance() crossZoomAndTime "2017 MEDIA_DEBUG_LOG("HCaptureSession::QueryZoomPerformance() crossZoomAndTime "
2015 "%{public}d, sessionID: %{public}d.",2018 "%{public}d, sessionID: %{public}d.",
@@ -2059,7 +2062,7 @@ void HCaptureSession::GetCrossZoomAndTime(
2059 std::vector<float>& crossZoomAndTime, std::vector<float>& crossZoom, std::vector<std::vector<float>>& crossTime)2062 std::vector<float>& crossZoomAndTime, std::vector<float>& crossZoom, std::vector<std::vector<float>>& crossTime)
2060{2063{
2061 int dataLenPerPoint = 3;2064 int dataLenPerPoint = 3;
2062- for (int i = 0; i < static_cast<int>(crossZoomAndTime.size()); i = i + dataLenPerPoint) {2065+ for (int i = 0; i + dataLenPerPoint <= static_cast<int>(crossZoomAndTime.size()); i = i + dataLenPerPoint) {
2063 if (crossZoomAndTime[i] != 0) {2066 if (crossZoomAndTime[i] != 0) {
2064 crossZoom.push_back(crossZoomAndTime[i]);2067 crossZoom.push_back(crossZoomAndTime[i]);
2065 }2068 }