mirror of
https://github.com/moonlight-stream/moonlight-common-c.git
synced 2026-10-26 05:49:59 +00:00
Fix use after free of queued controller packets
We could attempt to use a freed controller packet if - The connection terminated with one still queued - We hit the maximum input queue size limit In either of those cases we could both fail to send the desired input and cause memory corruption.
This commit is contained in:
1 parent
448b2c6868
commit
970b0729c5
1 file changed
+9
@@ -118,6 +118,7 @@ int initializeInputStream(void) {
|
|||||||
// Start with the virtual mouse centered
|
// Start with the virtual mouse centered
|
||||||
absCurrentPosX = absCurrentPosY = 0.5f;
|
absCurrentPosX = absCurrentPosY = 0.5f;
|
||||||
|
|
||||||
|
memset(currentQueuedControllerPacket, 0, sizeof(currentQueuedControllerPacket));
|
||||||
memset(currentGamepadSensorState, 0, sizeof(currentGamepadSensorState));
|
memset(currentGamepadSensorState, 0, sizeof(currentGamepadSensorState));
|
||||||
memset(¤tRelativeMouseState, 0, sizeof(currentRelativeMouseState));
|
memset(¤tRelativeMouseState, 0, sizeof(currentRelativeMouseState));
|
||||||
memset(¤tAbsoluteMouseState, 0, sizeof(currentAbsoluteMouseState));
|
memset(¤tAbsoluteMouseState, 0, sizeof(currentAbsoluteMouseState));
|
||||||
@@ -154,6 +155,7 @@ void destroyInputStream(void) {
|
|||||||
entry = nextEntry;
|
entry = nextEntry;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
memset(currentQueuedControllerPacket, 0, sizeof(currentQueuedControllerPacket));
|
||||||
PltDeleteMutex(&batchedInputMutex);
|
PltDeleteMutex(&batchedInputMutex);
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -1198,6 +1200,13 @@ static int sendControllerEventInternal(short controllerNumber, short activeGamep
|
|||||||
if (err != LBQ_SUCCESS) {
|
if (err != LBQ_SUCCESS) {
|
||||||
LC_ASSERT(err == LBQ_BOUND_EXCEEDED);
|
LC_ASSERT(err == LBQ_BOUND_EXCEEDED);
|
||||||
Limelog("Input queue reached maximum size limit\n");
|
Limelog("Input queue reached maximum size limit\n");
|
||||||
|
|
||||||
|
PltLockMutex(&batchedInputMutex);
|
||||||
|
if (currentQueuedControllerPacket[controllerNumber] == holder) {
|
||||||
|
currentQueuedControllerPacket[controllerNumber] = NULL;
|
||||||
|
}
|
||||||
|
PltUnlockMutex(&batchedInputMutex);
|
||||||
|
|
||||||
freePacketHolder(holder);
|
freePacketHolder(holder);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in new issue
Block a user