vcap/v4l2: ensure that buffer count doesn't ovrflw

Merely a theoretic case - this might (in default configuration) if driver
wants to use > 30 frames (while 3 are requested).

Author: MartinPulec

src/v4l2_common.h

@@ -4,8 +4,8 @@
  * @author  Martin Piatka    <piatka@cesnet.cz>
  * @author  Martin Pulec     <martin.pulec@cesnet.cz>
  */
- /*
- * Copyright (c) 2012-2025 CESNET
+/*
+ * Copyright (c) 2012-2026 CESNET, zájmové sdružení právnických osob
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -40,15 +40,21 @@
 #ifndef V4L2_COMMON_4B01337E_4F0D_48EC_91A7_D220AD919D3B
 #define V4L2_COMMON_4B01337E_4F0D_48EC_91A7_D220AD919D3B
 
+#include <assert.h>
+#include <errno.h>
 #include <linux/videodev2.h>
 #include <stdint.h>
 #include <sys/ioctl.h>
 #include <sys/mman.h>
 
-#include "types.h"
+#include "debug.h"
 #include "compat/strings.h" // for strerror_s
+#include "types.h"
 
-#define V4L2_PROBE_MAX 64
+enum {
+        V4L2_PROBE_MAX         = 64,
+        V4L2_CAP_MAX_BUF_COUNT = 30,
+};
 
 static struct {
         enum v4l2_field v4l_f;
@@ -136,6 +142,8 @@ static _Bool set_v4l2_buffers(int fd, struct v4l2_requestbuffers *reqbuf, struct
                 log_msg(LOG_LEVEL_ERROR, MOD_NAME "Not enough buffer memory\n");
                 return 0;
         }
+        assert(reqbuf->type != V4L2_BUF_TYPE_VIDEO_CAPTURE ||
+               reqbuf->count < V4L2_CAP_MAX_BUF_COUNT);
 
         for (unsigned int i = 0; i < reqbuf->count; i++) {
                 struct v4l2_buffer buf;

src/video_capture/v4l2.c

@@ -60,7 +60,6 @@
 
 enum {
         DEFAULT_BUF_COUNT = 3,
-        MAX_BUF_COUNT     = 30,
 };
 #define MOD_NAME "[V4L cap.] "
 
@@ -89,7 +88,7 @@ struct vidcap_v4l2_state {
         struct video_desc desc;
 
         int fd;
-        struct v4l2_buffer_data buffers[MAX_BUF_COUNT];
+        struct v4l2_buffer_data buffers[V4L2_CAP_MAX_BUF_COUNT];
 
         _Bool permissive; ///< do not fail if parameters (size, FPS...) not set exactly
 #ifdef HAVE_LIBV4LCONVERT
@@ -552,7 +551,7 @@ parse_fmt(char *fmt, struct parsed_opts *opts)
                                                 : atoi(strchr(item, '/') + 1);
                 } else if (IS_KEY_PREFIX(item, "buffers")) {
                         opts->buffer_count = atoi(strchr(item, '=') + 1);
-                        assert(opts->buffer_count <= MAX_BUF_COUNT);
+                        assert(opts->buffer_count <= V4L2_CAP_MAX_BUF_COUNT);
                 } else if (IS_KEY_PREFIX(item, "convert")) {
 #ifdef HAVE_LIBV4LCONVERT
                         const char *codec     = strchr(item, '=') + 1;