Is there any chance that ASLR would put libcamera_client.so in a lower memory location than get_input_buffer_size so you couldn't increment the pointer to reach it?
That's a great question! I didn't cover this in the blog post, but there is a primitive identical to the increment-by-one presented there, which allows me to decrement-by-one as well (I've gone into more detail in the exploit code: https://github.com/laginimaineb/cve-2014-7920-7921)