Skip to content

Commit e179c3f

Browse files
5an7y-Microsoft5an7y-Microsoft
authored
Merge pull request #1405 from microsoft/develop
RI develop -> main
2 parents ef7c307 + b150e03 commit e179c3f

19 files changed

Lines changed: 161 additions & 71 deletions

‎avstream/avscamera/DMFT/AvsCameraDMFT.cpp‎

Lines changed: 26 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,20 @@ CMultipinMft::CMultipinMft()
1414
: m_nRefCount( 0 ),
1515
m_InputPinCount( 0 ),
1616
m_OutputPinCount( 0 ),
17-
m_dwWorkQueueId ( MFASYNC_CALLBACK_QUEUE_MULTITHREADED ),
18-
m_lWorkQueuePriority ( 0 ),
19-
m_spAttributes( nullptr ),
17+
m_StreamingState( DeviceStreamState_Disabled ),
18+
m_OutPins(),
19+
m_InPins(),
20+
m_critSec(),
21+
m_spDeviceManagerUnk( nullptr ),
2022
m_spSourceTransform( nullptr ),
21-
m_SymbolicLink(nullptr)
23+
m_eShutdownStatus( MFSHUTDOWN_INITIATED ),
24+
m_dwWorkQueueId( MFASYNC_CALLBACK_QUEUE_MULTITHREADED ),
25+
m_lWorkQueuePriority( 0 ),
26+
m_punValue( 0 ),
27+
m_spIkscontrol( nullptr ),
28+
m_spAttributes( nullptr ),
29+
m_outputPinMap(),
30+
m_SymbolicLink( nullptr )
2231

2332
{
2433
HRESULT hr = S_OK;
@@ -189,7 +198,7 @@ IFACEMETHODIMP CMultipinMft::InitializeTransform (
189198
//
190199
// Create one on one mapping
191200
//
192-
for (ULONG ulIndex = 0; ulIndex < m_InPins.size(); ulIndex++)
201+
for (ULONG ulIndex = 0; ulIndex < (ULONG)(m_InPins.size()); ulIndex++)
193202
{
194203

195204
ComPtr<CInPin> spInPin = (CInPin*)m_InPins[ulIndex].Get();
@@ -378,12 +387,16 @@ IFACEMETHODIMP CMultipinMft::GetInputAvailableType(
378387
)
379388
{
380389
HRESULT hr = S_OK;
381-
390+
391+
if (ppMediaType)
392+
{
393+
*ppMediaType = nullptr;
394+
}
395+
382396
ComPtr<CInPin> spiPin = GetInPin( dwInputStreamID );
383397
DMFTCHECKNULL_GOTO(ppMediaType, done, E_INVALIDARG);
384398
DMFTCHECKNULL_GOTO( spiPin, done, MF_E_INVALIDSTREAMNUMBER );
385-
386-
*ppMediaType = nullptr;
399+
387400

388401
hr = spiPin->GetOutputAvailableType( dwTypeIndex,ppMediaType );
389402

@@ -417,12 +430,15 @@ IFACEMETHODIMP CMultipinMft::GetOutputAvailableType(
417430
CAutoLock Lock(m_critSec);
418431

419432
ComPtr<COutPin> spoPin = GetOutPin( dwOutputStreamID );
433+
434+
if (ppMediaType)
435+
{
436+
*ppMediaType = nullptr;
437+
}
420438

421439
DMFTCHECKNULL_GOTO( spoPin.Get(), done, MF_E_INVALIDSTREAMNUMBER );
422440
DMFTCHECKNULL_GOTO(ppMediaType, done, E_INVALIDARG);
423441

424-
*ppMediaType = nullptr;
425-
426442
hr = spoPin->GetOutputAvailableType( dwTypeIndex, ppMediaType );
427443

428444
if ( FAILED( hr ) )

‎avstream/avscamera/DMFT/AvsCameraDMFT.h‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -226,11 +226,6 @@ class CMultipinMft :
226226

227227
static HRESULT CreateInstance(
228228
REFIID iid, void **ppMFT);
229-
230-
__inline BOOL isPhotoModePhotoSequence()
231-
{
232-
return m_PhotoModeIsPhotoSequence;
233-
}
234229

235230
__inline DWORD GetQueueId()
236231
{
@@ -305,11 +300,9 @@ class CMultipinMft :
305300
private:
306301
ULONG m_InputPinCount;
307302
ULONG m_OutputPinCount;
308-
ULONG m_CustomPinCount;
309303
DeviceStreamState m_StreamingState;
310304
CBasePinArray m_OutPins;
311305
CBasePinArray m_InPins;
312-
BOOL m_PhotoModeIsPhotoSequence; // used to store if the filter is in photo sequence or not
313306
long m_nRefCount; // Reference count
314307
CCritSec m_critSec; // Control lock.. taken only durign state change operations
315308
ComPtr <IUnknown> m_spDeviceManagerUnk; // D3D Manager set, when MFT_MESSAGE_SET_D3D_MANAGER is called through ProcessMessage

‎avstream/avscamera/DMFT/AvsCameraDMFTutils.cpp‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -734,7 +734,9 @@ HRESULT ParseMetadata_FaceDetection(
734734
{
735735
return E_UNEXPECTED;
736736
}
737-
PMETADATA_FACEDATA pFaceData = (PMETADATA_FACEDATA)(pFaceHeader + 1);
737+
PMETADATA_FACEDATA pFaceData = reinterpret_cast<PMETADATA_FACEDATA>(
738+
reinterpret_cast<BYTE*>(pFaceHeader) + sizeof(CAMERA_METADATA_FACEHEADER));
739+
738740
UINT32 cbRectSize = sizeof(FaceRectInfoBlobHeader) + (sizeof(FaceRectInfo) * (pFaceHeader->Count));
739741
BYTE* pRectBuf = new (std::nothrow) BYTE[cbRectSize];
740742
if (pRectBuf == NULL)

‎avstream/avscamera/DMFT/basepin.h‎

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -90,11 +90,16 @@ class CBasePin:
9090
_Out_opt_ ULONG* pBytesReturned
9191
)
9292
{
93-
UNREFERENCED_PARAMETER(pBytesReturned);
94-
UNREFERENCED_PARAMETER(ulDataLength);
95-
UNREFERENCED_PARAMETER(pMethodData);
9693
UNREFERENCED_PARAMETER(pMethod);
9794
UNREFERENCED_PARAMETER(ulMethodLength);
95+
UNREFERENCED_PARAMETER(pMethodData);
96+
UNREFERENCED_PARAMETER(ulDataLength);
97+
98+
// Ensure *pBytesReturned is initialized if provided
99+
if (pBytesReturned != nullptr)
100+
{
101+
*pBytesReturned = 0;
102+
}
98103
return S_OK;
99104
}
100105

@@ -106,11 +111,16 @@ class CBasePin:
106111
_Out_opt_ ULONG* pBytesReturned
107112
)
108113
{
109-
UNREFERENCED_PARAMETER(pBytesReturned);
110-
UNREFERENCED_PARAMETER(ulDataLength);
111-
UNREFERENCED_PARAMETER(pEventData);
112114
UNREFERENCED_PARAMETER(pEvent);
113115
UNREFERENCED_PARAMETER(ulEventLength);
116+
UNREFERENCED_PARAMETER(pEventData);
117+
UNREFERENCED_PARAMETER(ulDataLength);
118+
119+
// Ensure *pBytesReturned is initialized if provided
120+
if (pBytesReturned != nullptr)
121+
{
122+
*pBytesReturned = 0;
123+
}
114124
return S_OK;
115125
}
116126

‎avstream/avscamera/sys/Capture.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1462,7 +1462,7 @@ Return Value:
14621462
//
14631463
if( Pin->DeviceState == KSSTATE_STOP )
14641464
{
1465-
if( !CapPin->CaptureBitmapInfoHeader( ) )
1465+
if( !NT_SUCCESS(CapPin->CaptureBitmapInfoHeader( )) )
14661466
{
14671467
Status = STATUS_INSUFFICIENT_RESOURCES;
14681468
}

‎avstream/avscamera/sys/Device.cpp‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,8 @@ CCaptureDevice (
4545
, m_FilterDescriptorCount(0)
4646
, m_Sensor(nullptr)
4747
, m_Context(nullptr)
48+
, m_DmaAdapterObject(nullptr)
49+
, m_NumberOfMapRegisters(0)
4850
{
4951
PAGED_CODE();
5052
}
@@ -85,9 +87,10 @@ CCaptureDevice::
8587
GetFilterIndex(PKSFILTER Filter)
8688
{
8789
PAGED_CODE();
90+
8891
ULONG i;
8992

90-
for( i=0; i<m_FilterDescriptorCount; i++ )
93+
for( i=0; i<(ULONG)m_FilterDescriptorCount; i++ )
9194
{
9295
if( Filter->Descriptor->ReferenceGuid &&
9396
IsEqualGUID(*(m_Context[i].Descriptor->ReferenceGuid), *Filter->Descriptor->ReferenceGuid))
@@ -130,13 +133,19 @@ QueryForInterface(
130133
_In_ USHORT Size,
131134
_In_ USHORT Version,
132135
_In_opt_ PVOID InterfaceSpecificData
133-
)
136+
)
134137
{
135138
PAGED_CODE();
136139

137140
PIRP pIrp;
138141
NTSTATUS status;
139142

143+
// Ensure the output parameter is initialized to a known state.
144+
if (Interface)
145+
{
146+
RtlZeroMemory(Interface, Size);
147+
}
148+
140149
if (TopOfStack == nullptr)
141150
{
142151
return STATUS_INVALID_PARAMETER;
@@ -181,7 +190,7 @@ QueryForInterface(
181190
KernelMode,
182191
FALSE, // Not alertable
183192
NULL
184-
);
193+
);
185194

186195
status = pIrp->IoStatus.Status;
187196
}
@@ -192,6 +201,12 @@ QueryForInterface(
192201
status = STATUS_INSUFFICIENT_RESOURCES;
193202
}
194203

204+
// If the call failed, ensure Interface is zeroed to avoid returning uninitialized memory.
205+
if (!NT_SUCCESS(status) && Interface)
206+
{
207+
RtlZeroMemory(Interface, Size);
208+
}
209+
195210
return status;
196211
}
197212

‎avstream/avscamera/sys/Device.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ class CCaptureDevice
7171
//
7272

7373
// Number of Filter descriptors & filter factories.
74-
size_t m_FilterDescriptorCount;
74+
ULONG m_FilterDescriptorCount;
7575

7676
// Pointer to an array of filter descriptor pointers.
7777
// Typically it's one sensor for each filter factory.
@@ -407,6 +407,7 @@ class CCaptureDevice
407407
static IO_COMPLETION_ROUTINE IrpSynchronousCompletion;
408408

409409
virtual
410+
_Must_inspect_result_
410411
NTSTATUS
411412
QueryForInterface(
412413
_In_ PDEVICE_OBJECT TopOfStack,

‎avstream/avscamera/sys/PreviewHwSim.cpp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -209,8 +209,8 @@ Return Value:
209209

210210
if (0 != (pStreamHeader->OptionsFlags & KSSTREAM_HEADER_OPTIONSF_METADATA))
211211
{
212-
PKS_FRAME_INFO pFrameInfo = (PKS_FRAME_INFO)(pStreamHeader + 1);
213-
PKSSTREAM_METADATA_INFO pMetadata = (PKSSTREAM_METADATA_INFO) (pFrameInfo + 1);
212+
PKS_FRAME_INFO pFrameInfo = (PKS_FRAME_INFO)((PUCHAR)pStreamHeader + sizeof(KSSTREAM_HEADER));
213+
PKSSTREAM_METADATA_INFO pMetadata = (PKSSTREAM_METADATA_INFO)((PUCHAR)pFrameInfo + sizeof(KS_FRAME_INFO));
214214
ULONG BytesLeft = pMetadata->BufferSize - pMetadata->UsedSize;
215215

216216
if(m_PhotoConfirmationEntry.isRequired())
@@ -325,7 +325,7 @@ Return Value:
325325
}
326326
else if ((State.Flags & KSCAMERA_EXTENDEDPROP_IRTORCHMODE_ALTERNATING_FRAME_ILLUMINATION))
327327
{
328-
m_Illuminated = !m_Illuminated;
328+
m_Illuminated = ~m_Illuminated;
329329
if (m_Illuminated)
330330
{
331331
pPreviewIllumination->Flags = KSCAMERA_METADATA_FRAMEILLUMINATION_FLAG_ON;

‎avstream/avscamera/sys/Roi.cpp‎

Lines changed: 21 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ Return Value:
143143

144144
// We assume the controls have been validated first.
145145
PKSCAMERA_EXTENDEDPROP_ROI_ISPCONTROL pIspCtrl =
146-
reinterpret_cast<PKSCAMERA_EXTENDEDPROP_ROI_ISPCONTROL> (this+1);
146+
reinterpret_cast<PKSCAMERA_EXTENDEDPROP_ROI_ISPCONTROL>(reinterpret_cast<PBYTE>(this) + sizeof(CRoiProperty));
147147

148148
// Loop thru the controls.
149149
for( ULONG i=0; i<m_Hdr.ControlCount; i++ )
@@ -155,6 +155,11 @@ Return Value:
155155

156156
// Advance to the next control.
157157
pIspCtrl = NextCtrl( pIspCtrl );
158+
if(pIspCtrl == nullptr)
159+
{
160+
NT_ASSERTMSG("NextCtrl( pCtrl ) returned 0! Should never happen!", FALSE);
161+
return nullptr;
162+
}
158163
}
159164

160165
return nullptr;
@@ -192,13 +197,18 @@ Return Value:
192197
{
193198
// We assume the controls have been validated first.
194199
PKSCAMERA_EXTENDEDPROP_ROI_ISPCONTROL pIspCtrl =
195-
reinterpret_cast<PKSCAMERA_EXTENDEDPROP_ROI_ISPCONTROL> (this+1);
200+
reinterpret_cast<PKSCAMERA_EXTENDEDPROP_ROI_ISPCONTROL>(reinterpret_cast<PBYTE>(this) + sizeof(CRoiProperty));
196201

197202
// Loop thru all the controls.
198203
for( ULONG i=0; i<m_Hdr.ControlCount; i++ )
199204
{
200205
// Advance to the next control.
201206
pIspCtrl = NextCtrl( pIspCtrl );
207+
if (pIspCtrl == nullptr)
208+
{
209+
NT_ASSERTMSG("NextCtrl( pCtrl ) returned 0! Should never happen!", FALSE);
210+
return nullptr;
211+
}
202212
}
203213

204214
ULONG SizeToCopy = ::GetSize(pCtrl);
@@ -277,14 +287,14 @@ Return Value:
277287
}
278288

279289
PKSCAMERA_EXTENDEDPROP_ROI_ISPCONTROL pIspCtrl =
280-
reinterpret_cast<PKSCAMERA_EXTENDEDPROP_ROI_ISPCONTROL> (this+1);
290+
reinterpret_cast<PKSCAMERA_EXTENDEDPROP_ROI_ISPCONTROL>(reinterpret_cast<BYTE*>(this) + sizeof(*this));
281291

282292
// Loop thru the controls.
283293
for( ULONG i=0; i<m_Hdr.ControlCount; i++ )
284294
{
285295
// Make sure there is room to inspect this control
286-
if( Size < ByteDiffPtrs( this, pIspCtrl+1 ) ||
287-
m_Hdr.Size < ByteDiffPtrs( &m_Hdr, pIspCtrl+1 ) )
296+
if( Size < ByteDiffPtrs( this, reinterpret_cast<PBYTE>(pIspCtrl) + sizeof(*pIspCtrl) ) ||
297+
m_Hdr.Size < ByteDiffPtrs( &m_Hdr, reinterpret_cast<PBYTE>(pIspCtrl) + sizeof(*pIspCtrl) ) )
288298
{
289299
//NT_ASSERT(FALSE);
290300
DBG_TRACE( "Failed(1): Size=%d, should be at least %Iu", Size, ByteDiffPtrs( this, pIspCtrl+1 ) );
@@ -324,7 +334,7 @@ Return Value:
324334
// Index into to the control's ROI list. Get the equivilent of "pIspCtrl->RoiInfo[j]"
325335
PKSCAMERA_EXTENDEDPROP_ROI_INFO pRoiInfo =
326336
reinterpret_cast<PKSCAMERA_EXTENDEDPROP_ROI_INFO>
327-
(((PBYTE) (pIspCtrl+1)) + (j * GetSizeOfRoiInfo(pIspCtrl->ControlId) ));
337+
((reinterpret_cast<PBYTE>(pIspCtrl) + sizeof(*pIspCtrl)) + (j * GetSizeOfRoiInfo(pIspCtrl->ControlId) ));
328338

329339
// Validate the cooridinates
330340
if( pRoiInfo->Region.top < (LONG) TO_Q31(0) ||
@@ -500,6 +510,11 @@ Log()
500510

501511
// Advance to the next control.
502512
pIspCtrl = reinterpret_cast<CRoiIspControl *>( NextCtrl( pIspCtrl ) ) ;
513+
if (pIspCtrl == nullptr)
514+
{
515+
NT_ASSERTMSG("NextCtrl( pCtrl ) returned 0! Should never happen!", FALSE);
516+
return;
517+
}
503518
}
504519
}
505520

0 commit comments

Comments
 (0)