mirror of
https://github.com/moonlight-stream/moonlight-common-c.git
synced 2026-10-26 05:49:59 +00:00
Fix use after free of queued controller packets
We could attempt to use a freed controller packet if - The connection terminated with one still queued - We hit the maximum input queue size limit In either of those cases we could both fail to send the desired input and cause memory corruption.
This commit is contained in:
1 parent
448b2c6868
commit
970b0729c5
1 file changed
+9
@@ -118,6 +118,7 @@ int initializeInputStream(void) {
|
||||
// Start with the virtual mouse centered
|
||||
absCurrentPosX = absCurrentPosY = 0.5f;
|
||||
|
||||
memset(currentQueuedControllerPacket, 0, sizeof(currentQueuedControllerPacket));
|
||||
memset(currentGamepadSensorState, 0, sizeof(currentGamepadSensorState));
|
||||
memset(¤tRelativeMouseState, 0, sizeof(currentRelativeMouseState));
|
||||
memset(¤tAbsoluteMouseState, 0, sizeof(currentAbsoluteMouseState));
|
||||
@@ -154,6 +155,7 @@ void destroyInputStream(void) {
|
||||
entry = nextEntry;
|
||||
}
|
||||
|
||||
memset(currentQueuedControllerPacket, 0, sizeof(currentQueuedControllerPacket));
|
||||
PltDeleteMutex(&batchedInputMutex);
|
||||
}
|
||||
|
||||
@@ -1198,6 +1200,13 @@ static int sendControllerEventInternal(short controllerNumber, short activeGamep
|
||||
if (err != LBQ_SUCCESS) {
|
||||
LC_ASSERT(err == LBQ_BOUND_EXCEEDED);
|
||||
Limelog("Input queue reached maximum size limit\n");
|
||||
|
||||
PltLockMutex(&batchedInputMutex);
|
||||
if (currentQueuedControllerPacket[controllerNumber] == holder) {
|
||||
currentQueuedControllerPacket[controllerNumber] = NULL;
|
||||
}
|
||||
PltUnlockMutex(&batchedInputMutex);
|
||||
|
||||
freePacketHolder(holder);
|
||||
}
|
||||
}
|
||||
|
||||
Reference in new issue
Block a user