Fix use after free of queued controller packets

We could attempt to use a freed controller packet if
- The connection terminated with one still queued
- We hit the maximum input queue size limit

In either of those cases we could both fail to send
the desired input and cause memory corruption.
This commit is contained in:
Cameron Gutman committed 2026-10-22 20:44:37 -05:00
1 parent 448b2c6868
commit 970b0729c5
1 file changed
+9
+9
View File
@@ -118,6 +118,7 @@ int initializeInputStream(void) {
// Start with the virtual mouse centered // Start with the virtual mouse centered
absCurrentPosX = absCurrentPosY = 0.5f; absCurrentPosX = absCurrentPosY = 0.5f;
memset(currentQueuedControllerPacket, 0, sizeof(currentQueuedControllerPacket));
memset(currentGamepadSensorState, 0, sizeof(currentGamepadSensorState)); memset(currentGamepadSensorState, 0, sizeof(currentGamepadSensorState));
memset(&currentRelativeMouseState, 0, sizeof(currentRelativeMouseState)); memset(&currentRelativeMouseState, 0, sizeof(currentRelativeMouseState));
memset(&currentAbsoluteMouseState, 0, sizeof(currentAbsoluteMouseState)); memset(&currentAbsoluteMouseState, 0, sizeof(currentAbsoluteMouseState));
@@ -154,6 +155,7 @@ void destroyInputStream(void) {
entry = nextEntry; entry = nextEntry;
} }
memset(currentQueuedControllerPacket, 0, sizeof(currentQueuedControllerPacket));
PltDeleteMutex(&batchedInputMutex); PltDeleteMutex(&batchedInputMutex);
} }
@@ -1198,6 +1200,13 @@ static int sendControllerEventInternal(short controllerNumber, short activeGamep
if (err != LBQ_SUCCESS) { if (err != LBQ_SUCCESS) {
LC_ASSERT(err == LBQ_BOUND_EXCEEDED); LC_ASSERT(err == LBQ_BOUND_EXCEEDED);
Limelog("Input queue reached maximum size limit\n"); Limelog("Input queue reached maximum size limit\n");
PltLockMutex(&batchedInputMutex);
if (currentQueuedControllerPacket[controllerNumber] == holder) {
currentQueuedControllerPacket[controllerNumber] = NULL;
}
PltUnlockMutex(&batchedInputMutex);
freePacketHolder(holder); freePacketHolder(holder);
} }
} }