From 970b0729c57a9affa7b4c8a31eea35ae59dbe916 Mon Sep 17 00:00:00 2001 From: Cameron Gutman Date: Thu, 22 Oct 2026 20:44:37 -0500 Subject: [PATCH] Fix use after free of queued controller packets We could attempt to use a freed controller packet if - The connection terminated with one still queued - We hit the maximum input queue size limit In either of those cases we could both fail to send the desired input and cause memory corruption. --- src/InputStream.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/InputStream.c b/src/InputStream.c index 1a4c5a6..33de6c1 100644 --- a/src/InputStream.c +++ b/src/InputStream.c @@ -118,6 +118,7 @@ int initializeInputStream(void) { // Start with the virtual mouse centered absCurrentPosX = absCurrentPosY = 0.5f; + memset(currentQueuedControllerPacket, 0, sizeof(currentQueuedControllerPacket)); memset(currentGamepadSensorState, 0, sizeof(currentGamepadSensorState)); memset(¤tRelativeMouseState, 0, sizeof(currentRelativeMouseState)); memset(¤tAbsoluteMouseState, 0, sizeof(currentAbsoluteMouseState)); @@ -154,6 +155,7 @@ void destroyInputStream(void) { entry = nextEntry; } + memset(currentQueuedControllerPacket, 0, sizeof(currentQueuedControllerPacket)); PltDeleteMutex(&batchedInputMutex); } @@ -1198,6 +1200,13 @@ static int sendControllerEventInternal(short controllerNumber, short activeGamep if (err != LBQ_SUCCESS) { LC_ASSERT(err == LBQ_BOUND_EXCEEDED); Limelog("Input queue reached maximum size limit\n"); + + PltLockMutex(&batchedInputMutex); + if (currentQueuedControllerPacket[controllerNumber] == holder) { + currentQueuedControllerPacket[controllerNumber] = NULL; + } + PltUnlockMutex(&batchedInputMutex); + freePacketHolder(holder); } }