dukus / digiCamControl

DSLR camera remote control open source software
http://digicamcontrol.com/
Other
654 stars 224 forks source link

Reference of undeclared memory; possible infinite loop or crash #401

Closed g-hauer closed 1 year ago

g-hauer commented 1 year ago

https://github.com/dukus/digiCamControl/blob/119b56134f9c99c90ce5ff17058a3622b4ae917b/PortableDeviceLib/StillImageDevice.cs#L291

the property vparam1 is declared within the loop and has a lifetime within the loop; it is added to the propVariant-list as ref, but at the end of the loop, referenced memory of the variable does no longer exist or is used by something else. so the call of ExecuteReadData uses unallocated memory. (within my build, it creates an infinite loop, preventing the cam-software from receiving events)

`public MTPDataResponse ExecuteReadData(uint code, params uint[] parameters) { IPortableDevicePropVariantCollection propVariant = (IPortableDevicePropVariantCollection)new PortableDeviceTypesLib.PortableDevicePropVariantCollection();

        foreach (uint parameter in parameters)
        {
            tag_inner_PROPVARIANT vparam1 = new tag_inner_PROPVARIANT();
            UintToPropVariant(parameter, out vparam1);
            propVariant.Add(ref vparam1);

        }
        return ExecuteReadData(code, propVariant);
    }`

i suggest to fix the function in this way:

`public MTPDataResponse ExecuteReadData(uint code, params uint[] parameters) { IPortableDevicePropVariantCollection propVariant = (IPortableDevicePropVariantCollection)new PortableDeviceTypesLib.PortableDevicePropVariantCollection();

        tag_inner_PROPVARIANT[] vparams = new tag_inner_PROPVARIANT[parameters.Length];
        for (int i = 0; i < parameters.Length; i++)
        {
            UintToPropVariant(parameters[i], out vparams[i]);
            propVariant.Add(ref vparams[i]);
        }
        return ExecuteReadData(code, propVariant);
    }`