fix(uvc): add MJPEG checks for uvc

Author: TDA-2030

host/class/uvc/usb_host_uvc/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 2.3.2
+
+- Added SOI check to prevent output of corrupted MJPEG frames
+- Moved `usb_types_uvc.h` to `private_include` directory
+
 ## 2.3.1
 
 - Added support for ESP32-H4

host/class/uvc/usb_host_uvc/idf_component.yml

@@ -1,5 +1,5 @@
 ## IDF Component Manager Manifest File
-version: "2.3.1"
+version: "2.3.2"
 description: USB Host UVC driver
 url: https://github.com/espressif/esp-usb/tree/master/host/class/uvc/usb_host_uvc
 dependencies:

host/class/uvc/usb_host_uvc/include/esp_private/uvc_control.h

@@ -7,6 +7,7 @@
 #pragma once
 
 #include "usb/uvc_host.h"
+#include "usb_types_uvc.h"
 
 #ifdef __cplusplus
 extern "C" {

host/class/uvc/usb_host_uvc/include/usb/uvc_host.h

@@ -8,7 +8,6 @@
 
 #include <stdbool.h>
 #include "usb/usb_host.h"
-#include "usb/usb_types_uvc.h"
 #include "esp_err.h"
 
 // Use this macros for opening a UVC stream with any VID or PID

host/class/uvc/usb_host_uvc/include/usb/usb_types_uvc.h renamed to host/class/uvc/usb_host_uvc/private_include/usb_types_uvc.h

@@ -10,7 +10,7 @@
 // So we include only files with USB specification definitions
 // This interface is also used in host_tests
 #include "usb/usb_types_ch9.h"
-#include "usb/usb_types_uvc.h"
+#include "usb_types_uvc.h"
 
 #define UVC_DESC_FPS_TO_DWFRAMEINTERVAL(fps) (((fps) != 0) ? 10000000.0f / (fps) : 0)
 #define UVC_DESC_DWFRAMEINTERVAL_TO_FPS(dwFrameInterval) (((dwFrameInterval) != 0) ? 10000000.0f / ((float)(dwFrameInterval)) : 0)

host/class/uvc/usb_host_uvc/private_include/uvc_descriptors_priv.h

@@ -12,6 +12,7 @@
 
 #include "usb/usb_host.h"
 #include "usb/uvc_host.h"
+#include "usb_types_uvc.h"
 
 #include "freertos/FreeRTOS.h"
 #include "freertos/queue.h"

host/class/uvc/usb_host_uvc/private_include/uvc_types_priv.h

@@ -125,6 +125,14 @@ void bulk_transfer_callback(usb_transfer_t *transfer)
         uvc_stream->single_thread.current_frame_id   = payload_header->bmHeaderInfo.frame_id;
         uvc_stream->single_thread.skip_current_frame = payload_header->bmHeaderInfo.error; // Check for error flag
 
+        // Check mjpeg frame start
+        if (uvc_stream->dynamic.vs_format.format == UVC_VS_FORMAT_MJPEG &&
+                payload_data[payload_header->bHeaderLength] != 0xff && payload_data[1 + payload_header->bHeaderLength] != 0xd8) {
+            // We received frame with invalid frame, skip this frame
+            uvc_stream->single_thread.skip_current_frame = true;
+            ESP_LOGW(TAG, "invalid MJPEG SOI");
+        }
+
         // Get free frame buffer for this new frame
         UVC_ENTER_CRITICAL();
         const bool need_new_frame = (uvc_stream->dynamic.streaming && !uvc_stream->dynamic.current_frame);

host/class/uvc/usb_host_uvc/uvc_bulk.c

@@ -12,7 +12,7 @@
 
 #include "uvc_control.h"
 #include "usb/usb_types_ch9.h"
-#include "usb/usb_types_uvc.h"
+#include "usb_types_uvc.h"
 #include "uvc_types_priv.h"
 #include "uvc_descriptors_priv.h"
 #include "uvc_check_priv.h"

host/class/uvc/usb_host_uvc/uvc_control.c

@@ -87,12 +87,34 @@ void isoc_transfer_callback(usb_transfer_t *transfer)
 
         // Check for start of new frame
         const uvc_payload_header_t *payload_header = (const uvc_payload_header_t *)payload;
+        // Derive payload data pointer/length once and reuse below
+        const uint8_t *payload_data = payload + payload_header->bHeaderLength;
+        const size_t payload_data_len = isoc_desc->actual_num_bytes - payload_header->bHeaderLength;
+
+        if (payload_data_len == 0) {
+            goto next_isoc_packet;
+        }
+
+        // Check for error flag
+        if (payload_header->bmHeaderInfo.error) {
+            ESP_LOGW(TAG, "frame error");
+            uvc_stream->single_thread.skip_current_frame = true;
+        }
+
         const bool start_of_frame = (uvc_stream->single_thread.current_frame_id != payload_header->bmHeaderInfo.frame_id);
         if (start_of_frame) {
             // We detected start of new frame. Update Frame ID and start fetching this frame
             uvc_stream->single_thread.current_frame_id   = payload_header->bmHeaderInfo.frame_id;
             uvc_stream->single_thread.skip_current_frame = payload_header->bmHeaderInfo.error;
 
+            // Check mjpeg frame start
+            if (uvc_stream->dynamic.vs_format.format == UVC_VS_FORMAT_MJPEG &&
+                    payload_data[0] != 0xff && payload_data[1] != 0xd8) {
+                // We received frame with invalid frame, skip this frame
+                uvc_stream->single_thread.skip_current_frame = true;
+                ESP_LOGW(TAG, "invalid MJPEG SOI");
+            }
+
             // Get free frame buffer for this new frame
             UVC_ENTER_CRITICAL();
             const bool need_new_frame = (uvc_stream->dynamic.streaming && !uvc_stream->dynamic.current_frame);
@@ -115,20 +137,15 @@ void isoc_transfer_callback(usb_transfer_t *transfer)
                 }
             } else {
                 // We received SoF but current_frame is not NULL: We missed EoF - reset the frame buffer
+                ESP_EARLY_LOGW(TAG, "missed EoF");
+                uvc_stream->single_thread.skip_current_frame = true;
                 uvc_frame_reset(uvc_stream->dynamic.current_frame);
                 UVC_EXIT_CRITICAL();
             }
         }
 
-        // Check for error flag
-        if (payload_header->bmHeaderInfo.error) {
-            uvc_stream->single_thread.skip_current_frame = true;
-        }
-
         // Add received data to frame buffer
         if (!uvc_stream->single_thread.skip_current_frame) {
-            const uint8_t *payload_data = payload + payload_header->bHeaderLength;
-            const size_t payload_data_len = isoc_desc->actual_num_bytes - payload_header->bHeaderLength;
             uvc_host_frame_t *current_frame = UVC_ATOMIC_LOAD(uvc_stream->dynamic.current_frame);
 
             esp_err_t ret = uvc_frame_add_data(current_frame, payload_data, payload_data_len);
@@ -157,6 +174,11 @@ void isoc_transfer_callback(usb_transfer_t *transfer)
             uvc_host_frame_t *this_frame = uvc_stream->dynamic.current_frame;
             uvc_stream->dynamic.current_frame = NULL; // Stop writing more data to this frame
 
+            if (this_frame && this_frame->data_len <= 2) {
+                // We received too small frame, skip this frame
+                uvc_stream->single_thread.skip_current_frame = true;
+            }
+
             // Determine if we should invoke the frame callback:
             // Only invoke the callback if streaming is active, a frame callback exists,
             // and we have a valid frame to pass to the user.