Change rs2_get_composite_option to SDK-allocated rs2_raw_data_buffer ownership model, matching rs2_get_safety_preset

The caller has no generic way to know a given rs2_composite_option_id's wire
size in advance (only the SDK-side control for that id knows it), so
requiring a pre-sized caller buffer was unsafe. rs2_get_composite_option now
returns an SDK-heap-allocated rs2_raw_data_buffer, read via
rs2_get_raw_data_size/rs2_get_raw_data and freed via rs2_delete_raw_data -
mirroring rs2_get_safety_preset exactly. rs2::composite_option_sensor::
get_composite_option hides this behind a std::vector<uint8_t> return, same
as rs2::safety_sensor::get_safety_preset. rs2_set_composite_option is
unchanged: the caller/producer already knows sizeof() of what it sends.

xu_structured_control::get_raw and composite_option_interface::
get_composite_option now return std::vector<uint8_t> sized to the control's
known wire_size instead of writing into a caller-supplied void*/size pair.
Updated the realsense-viewer panel and the fake-transport mock example to
the new contract; both still verify round-trip correctness and the
exactly-one-set_xu/one-get_xu atomicity guarantee.

Author: Evgeni Raikhel

common/device-model.cpp

@@ -5,6 +5,8 @@
 #include <librealsense2/rs.hpp>
 #include <rs-config.h>
 
+#include <cstring>
+
 #include <third-party/filesystem/glob.h>
 
 #include <imgui.h>
@@ -2789,9 +2791,12 @@ namespace rs2
                         {
                             if (!sub->temporal_filter_dpp_populated)
                             {
+                                auto bytes = composite_sensor.get_composite_option(RS2_COMPOSITE_OPTION_HKR_TEMPORAL_FILTER_DPP);
+                                if (bytes.size() != sizeof(rs2_temporal_filter_dpp_config))
+                                    throw std::runtime_error("HKR Temporal Filter DPP: unexpected payload size from get_composite_option");
+
                                 rs2_temporal_filter_dpp_config cfg{};
-                                unsigned int data_size = sizeof(cfg);
-                                composite_sensor.get_composite_option(RS2_COMPOSITE_OPTION_HKR_TEMPORAL_FILTER_DPP, &cfg, &data_size);
+                                memcpy(&cfg, bytes.data(), sizeof(cfg));
                                 sub->temporal_filter_dpp_enabled = cfg.enabled;
                                 sub->temporal_filter_dpp_smooth_alpha = cfg.smooth_alpha;
                                 sub->temporal_filter_dpp_smooth_delta = cfg.smooth_delta;
@@ -2828,6 +2833,10 @@ namespace rs2
                         {
                             error_message = error_to_string(e);
                         }
+                        catch (const std::exception& e)
+                        {
+                            error_message = e.what();
+                        }
 
                         ImGui::TreePop();
                     }

examples/hkr-temporal-filter-dpp-mock/rs-hkr-temporal-filter-dpp-mock.cpp

@@ -11,10 +11,12 @@
 // hardware test.
 //
 // What this proves:
-//   1. Round-trip correctness: a payload sent via set_raw() comes back byte-identical via
-//      get_raw(), when cast back to the caller's typed struct (rs2_temporal_filter_dpp_config)
-//      - exactly the caller-casts-the-void* contract of the real rs2_set/get_composite_option
-//      API.
+//   1. Round-trip correctness: a payload sent via set_raw(void*, size) comes back
+//      byte-identical in the SDK-allocated vector returned by get_raw(), once memcpy'd into
+//      the caller's typed struct (rs2_temporal_filter_dpp_config) - exactly the contract of
+//      the real rs2_set_composite_option(data, data_size) / rs2_get_composite_option()
+//      (which returns an rs2_raw_data_buffer, since the caller has no generic way to know an
+//      arbitrary option_id's wire size in advance - mirrors rs2_get_safety_preset).
 //   2. Atomicity: set_raw() performs EXACTLY ONE set_xu() call, and get_raw() performs
 //      EXACTLY ONE get_xu() call - i.e. the whole payload always travels as a single UVC
 //      transaction, never as separate per-field writes/reads. This is the non-negotiable
@@ -120,11 +122,19 @@ try
     sent.smooth_delta = 20;
     sent.persistency_index = 3;
 
-    // Caller casts to/from void* - exactly the contract of rs2_set/get_composite_option.
+    // Caller casts to/from void* - exactly the contract of rs2_set/get_composite_option. SET
+    // still takes a caller-owned buffer (the caller/producer already knows sizeof() of what
+    // it's sending). GET returns an SDK-owned, correctly-sized vector - the caller has no
+    // generic way to know a given option_id's wire size in advance - mirroring
+    // rs2_get_safety_preset/rs2::safety_sensor::get_safety_preset.
     control.set_raw( dev, &sent, sizeof( sent ) );
 
+    std::vector< uint8_t > bytes = control.get_raw( dev );
+    if( bytes.size() != sizeof( rs2_temporal_filter_dpp_config ) )
+        throw std::runtime_error( "get_raw returned an unexpected payload size" );
+
     rs2_temporal_filter_dpp_config received{};
-    control.get_raw( dev, &received, sizeof( received ) );
+    std::memcpy( &received, bytes.data(), sizeof( received ) );
 
     // 1) Round-trip correctness.
     bool round_trip_ok = ( received.enabled == sent.enabled )

include/librealsense2/h/rs_composite_option.h

@@ -56,15 +56,18 @@ void rs2_set_composite_option(const rs2_sensor* sensor, rs2_composite_option_id
 /**
 * rs2_get_composite_option - generic composite-option getter.
 * Reads the current value from the device in ONE atomic UVC control transaction (one get_xu
-* call) into the caller-provided buffer.
-* \param[in]     sensor       Sensor that exposes the requested composite option
-* \param[in]     option_id    Which composite option to read
-* \param[out]    data         Pointer to the caller's typed payload struct (written on success)
-* \param[in,out] data_size    On input: size of the caller's buffer (must be >= the option's
-*                              wire size). On output: the number of bytes actually written.
-* \param[out]    error        If non-null, receives any error that occurs during this call, otherwise, errors are ignored
+* call). The caller has no generic way to know the wire size of an arbitrary option_id in
+* advance (only the SDK-side control for that specific id knows it), so the SDK heap-allocates
+* and returns the result as an rs2_raw_data_buffer - read its bytes with rs2_get_raw_data_size/
+* rs2_get_raw_data and free it with rs2_delete_raw_data when done (mirrors rs2_get_safety_preset).
+* \param[in]   sensor       Sensor that exposes the requested composite option
+* \param[in]   option_id    Which composite option to read
+* \param[out]  error        If non-null, receives any error that occurs during this call, otherwise, errors are ignored
+* \return                   SDK-allocated buffer holding the option's raw payload bytes; the
+*                            caller casts them to the typed struct that corresponds to option_id
+*                            (e.g. rs2_temporal_filter_dpp_config). Free with rs2_delete_raw_data.
 */
-void rs2_get_composite_option(const rs2_sensor* sensor, rs2_composite_option_id option_id, void* data, unsigned int* data_size, rs2_error** error);
+const rs2_raw_data_buffer* rs2_get_composite_option(const rs2_sensor* sensor, rs2_composite_option_id option_id, rs2_error** error);
 
 #ifdef __cplusplus
 }

include/librealsense2/hpp/rs_composite_option.hpp

@@ -41,12 +41,29 @@ namespace rs2
             error::handle(e);
         }
 
-        // Single atomic UVC transaction (one get_xu round trip).
-        void get_composite_option(rs2_composite_option_id option_id, void* data, unsigned int* data_size) const
+        // Single atomic UVC transaction (one get_xu round trip). The SDK allocates the result
+        // (the caller has no generic way to know option_id's wire size in advance) and this
+        // wrapper hides the raw rs2_raw_data_buffer/manual-free entirely, returning a plain
+        // std::vector<uint8_t> of the option's raw payload bytes - cast/memcpy them into the
+        // typed struct that corresponds to option_id (e.g. rs2_temporal_filter_dpp_config).
+        std::vector<uint8_t> get_composite_option(rs2_composite_option_id option_id) const
         {
             rs2_error* e = nullptr;
-            rs2_get_composite_option(_sensor.get(), option_id, data, data_size, &e);
+            auto buffer = rs2_get_composite_option(_sensor.get(), option_id, &e);
+
+            std::shared_ptr<const rs2_raw_data_buffer> list(buffer, rs2_delete_raw_data);
+            error::handle(e);
+
+            auto size = rs2_get_raw_data_size(list.get(), &e);
             error::handle(e);
+
+            auto start = rs2_get_raw_data(list.get(), &e);
+            error::handle(e);
+
+            std::vector<uint8_t> result;
+            result.insert(result.begin(), start, start + size);
+
+            return result;
         }
     };
 }

src/composite-option-interface.h

@@ -12,6 +12,9 @@
 #include "core/extension.h"
 #include <librealsense2/h/rs_composite_option.h>
 
+#include <vector>
+#include <cstdint>
+
 namespace librealsense {
 
 class composite_option_interface
@@ -20,11 +23,15 @@ class composite_option_interface
     virtual ~composite_option_interface() = default;
 
     // Generic dispatch by option id. Each call performs EXACTLY ONE UVC control transaction
-    // (one set_xu/get_xu). data/data_size are an opaque byte blob whose layout is defined by
-    // whichever typed struct corresponds to option_id (e.g. rs2_temporal_filter_dpp_config for
+    // (one set_xu/get_xu). The bytes are an opaque blob whose layout is defined by whichever
+    // typed struct corresponds to option_id (e.g. rs2_temporal_filter_dpp_config for
     // RS2_COMPOSITE_OPTION_HKR_TEMPORAL_FILTER_DPP) - the caller is responsible for casting.
+    //
+    // get_composite_option returns a vector sized exactly to that option's known wire size -
+    // the caller has no generic way to know that size in advance, so the SDK owns the
+    // allocation (mirrors librealsense::safety_sensor::get_safety_preset).
     virtual void set_composite_option( rs2_composite_option_id option_id, const void * data, uint32_t data_size ) = 0;
-    virtual void get_composite_option( rs2_composite_option_id option_id, void * data, uint32_t * data_size ) const = 0;
+    virtual std::vector< uint8_t > get_composite_option( rs2_composite_option_id option_id ) const = 0;
 };
 
 MAP_EXTENSION( RS2_EXTENSION_COMPOSITE_OPTIONS, librealsense::composite_option_interface );

src/ds/d500/d500-device.cpp

@@ -155,7 +155,7 @@ namespace librealsense
             [&control, data, data_size]( platform::uvc_device & dev ) { control.set_raw( dev, data, data_size ); } );
     }
 
-    void d500_depth_sensor::get_composite_option( rs2_composite_option_id option_id, void * data, uint32_t * data_size ) const
+    std::vector< uint8_t > d500_depth_sensor::get_composite_option( rs2_composite_option_id option_id ) const
     {
         auto it = _structured_controls.find( option_id );
         if( it == _structured_controls.end() )
@@ -167,10 +167,8 @@ namespace librealsense
             throw wrong_api_call_sequence_exception( "composite option is not available: no raw depth sensor" );
 
         auto & control = it->second;
-        uint32_t wire_size = control.wire_size();
-        raw_depth_sensor->invoke_powered(
-            [&control, data, data_size]( platform::uvc_device & dev ) { control.get_raw( dev, data, *data_size ); } );
-        *data_size = wire_size;
+        return raw_depth_sensor->invoke_powered(
+            [&control]( platform::uvc_device & dev ) { return control.get_raw( dev ); } );
     }
 
     processing_blocks d500_depth_sensor::get_recommended_processing_blocks() const

src/ds/d500/d500-device.h

@@ -70,7 +70,7 @@ namespace librealsense
         // xu_structured_control handles the call is selected by option_id at runtime via
         // _structured_controls - there is no per-feature method here, only registration.
         void set_composite_option( rs2_composite_option_id option_id, const void * data, uint32_t data_size ) override;
-        void get_composite_option( rs2_composite_option_id option_id, void * data, uint32_t * data_size ) const override;
+        std::vector< uint8_t > get_composite_option( rs2_composite_option_id option_id ) const override;
 
     protected:
         d500_device * _owner;

src/ds/structured-xu-control.cpp

@@ -8,14 +8,15 @@
 
 namespace librealsense {
 
-void xu_structured_control::get_raw( platform::uvc_device & dev, void * data, uint32_t data_size ) const
+std::vector< uint8_t > xu_structured_control::get_raw( platform::uvc_device & dev ) const
 {
-    if( data_size < _wire_size )
-        throw std::runtime_error( "xu_structured_control::get_raw: caller buffer smaller than the control's wire size" );
+    std::vector< uint8_t > data( _wire_size );
 
     // Exactly one get_xu() call - the whole payload arrives atomically.
-    if( ! dev.get_xu( _xu, _ctrl_id, reinterpret_cast< uint8_t * >( data ), (int)_wire_size ) )
+    if( ! dev.get_xu( _xu, _ctrl_id, data.data(), (int)_wire_size ) )
         throw std::runtime_error( "get_xu() failed" );
+
+    return data;
 }
 
 void xu_structured_control::set_raw( platform::uvc_device & dev, const void * data, uint32_t data_size ) const

src/ds/structured-xu-control.h

@@ -26,6 +26,9 @@
 
 #include <src/platform/uvc-device.h>
 
+#include <vector>
+#include <cstdint>
+
 namespace librealsense {
 
 class xu_structured_control
@@ -40,8 +43,10 @@ class xu_structured_control
 
     uint32_t wire_size() const { return _wire_size; }
 
-    // Exactly one get_xu() call. Throws if data_size is smaller than this control's wire size.
-    void get_raw( platform::uvc_device & dev, void * data, uint32_t data_size ) const;
+    // Exactly one get_xu() call. Returns a vector sized exactly wire_size() - this class is
+    // the one place that knows the control's wire size, so it owns the allocation rather than
+    // requiring the caller to guess a buffer size upfront.
+    std::vector< uint8_t > get_raw( platform::uvc_device & dev ) const;
 
     // Exactly one set_xu() call - the whole wire_size() payload sent together. Throws if
     // data_size does not exactly match this control's wire size.

src/rs.cpp

@@ -4851,21 +4851,18 @@ void rs2_set_composite_option(
 }
 HANDLE_EXCEPTIONS_AND_RETURN(, sensor, option_id, data, data_size)
 
-void rs2_get_composite_option(
+const rs2_raw_data_buffer* rs2_get_composite_option(
     rs2_sensor const* sensor,
     rs2_composite_option_id option_id,
-    void* data,
-    unsigned int* data_size,
     rs2_error** error) BEGIN_API_CALL
 {
     VALIDATE_NOT_NULL(sensor);
     VALIDATE_ENUM(option_id);
-    VALIDATE_NOT_NULL(data);
-    VALIDATE_NOT_NULL(data_size);
     auto composite = VALIDATE_INTERFACE(sensor->sensor, librealsense::composite_option_interface);
-    composite->get_composite_option(option_id, data, data_size);
+    std::vector<uint8_t> vec = composite->get_composite_option(option_id);
+    return new rs2_raw_data_buffer{ std::move(vec) };
 }
-HANDLE_EXCEPTIONS_AND_RETURN(, sensor, option_id, data, data_size)
+HANDLE_EXCEPTIONS_AND_RETURN(nullptr, sensor, option_id)
 
 void rs2_hw_monitor_get_opcode_string(int opcode, char* buffer, size_t buffer_size,
     rs2_device* device,