[Crash] Null pointer dereference in libaandusb.so (Endpoint::get_max_packet_size) #25
Description
Environment
Unity version: 2022.3.52f1 (il2cpp, arm64-v8a)
Device: Samsung Galaxy Tab S7 FE (gts7fewifi)
Android version: 14 (UP1A.231005.007)
Plugin: com.serenegiant.uvc4unityandroid
ABI: arm64
Issue
When starting a USB camera stream (using an IPEVO UVC camera), the application crashes with a segmentation fault (signal 11, SIGSEGV) inside libaandusb.so. The crash occurs due to a null pointer dereference in serenegiant::usb::Endpoint::get_max_packet_size() during bandwidth negotiation.
Crash Log (excerpt)
Version '2022.3.52f1 (1120fcb54228)', Build type 'Release', Scripting Backend 'il2cpp', CPU 'arm64-v8a' Build fingerprint: 'samsung/gts7fewifixx/gts7fewifi:14/UP1A.231005.007/T733XXS9DYF1:user/release-keys' Revision: '2' ABI: 'arm64' Timestamp: 2025-09-22 17:33:01.867558624+0800 pid: 25605, tid: 25710, name: UnityMain >>> com.serenegiant.uvc4unityandroid <<< uid: 10784 signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr -------- Cause: null pointer dereference x0 0000000000000000 x1 0000007523aa9afc x2 0000007523aa9b00 x3 0000007523aa9af8 x4 0000007523aa9afc x5 b40000781367b020 x6 0000007523aa9b08 x7 0000007523aa9b84 x8 0000000000000000 x9 0000000000000000 x10 0000000000000001 x11 0000000000000000 x12 0000000000000000 x13 0000007640106000 x14 0000007640025000 x15 0000000034155555 x16 0000007648bf8010 x17 0000007648b6b330 x18 0000007522ccc000 x19 b40000781367ada0 x20 0000007523aa9b00 x21 0000007523aa9af8 x22 0000007523aa9b04 x23 0000007523aa9b08 x24 b40000781367b020 x25 0000007523aa9afc x26 0000007523aa9b84 x27 0000007523aaa000 x28 0000000000200000 x29 0000007523aa9a70 lr 0000007648ba4744 sp 0000007523aa9a60 pc 0000007648b6b330 pst 0000000060001000 backtrace: #00 pc 0000000000105330 /data/app/~~XtmYEcMfggiN5liymKmtww==/com.serenegiant.uvc4unityandroid-NtWdrDDU0eqkwPeEwZ_AEw==/lib/arm64/libaandusb.so (serenegiant::usb::Endpoint::get_max_packet_size() const) (BuildId: 93bf40fce00eb4da3bf5e8ac854a3a823c869183) #01 pc 000000000013e740 /data/app/~~XtmYEcMfggiN5liymKmtww==/com.serenegiant.uvc4unityandroid-NtWdrDDU0eqkwPeEwZ_AEw==/lib/arm64/libaandusb.so (serenegiant::usb::uvc::UVCStream::negotiate_bandwidth(unsigned int&, unsigned int&, unsigned int&, unsigned char const&, serenegiant::usb::uvc::_uvc_streaming_control const&, unsigned int const&, bool const&, float const&)+228) (BuildId: 93bf40fce00eb4da3bf5e8ac854a3a823c8691 #02 pc 000000000013e2ac /data/app/~~XtmYEcMfggiN5liymKmtww==/com.serenegiant.uvc4unityandroid-NtWdrDDU0eqkwPeEwZ_AEw==/lib/arm64/libaandusb.so (serenegiant::usb::uvc::UVCStream::start(bool const&)+1208) (BuildId: 93bf40fce00eb4da3bf5e8ac854a3a823c869183) #03 pc 00000000001101c0 /data/app/~~XtmYEcMfggiN5liymKmtww==/com.serenegiant.uvc4unityandroid-NtWdrDDU0eqkwPeEwZ_AEw==/lib/arm64/libaandusb.so (serenegiant::usb::uvc::UVCCameraBase::internal_start_stream()+80) (BuildId: 93bf40fce00eb4da3bf5e8ac854a3a823c869183) #04 pc 00000000001103f4 /data/app/~~XtmYEcMfggiN5liymKmtww==/com.serenegiant.uvc4unityandroid-NtWdrDDU0eqkwPeEwZ_AEw==/lib/arm64/libaandusb.so (serenegiant::usb::uvc::UVCCameraBase::stream_thread_func()+268) (BuildId: 93bf40fce00eb4da3bf5e8ac854a3a823c869183) #05 pc 0000000000110974 /data/app/~~XtmYEcMfggiN5liymKmtww==/com.serenegiant.uvc4unityandroid-NtWdrDDU0eqkwPeEwZ_AEw==/lib/arm64/libaandusb.so (BuildId: 93bf40fce00eb4da3bf5e8ac854a3a823c869183) #06 pc 00000000000c3774 /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+208) (BuildId: 915f3092e188c08142d3ac57b655fbd7) #07 pc 000000000005d044 /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68) (BuildId: 915f3092e188c08142d3ac57b655fbd7)