Skip to content

fix(hidpp20): AdjustableDPI getSensorDPIList loop off-by-one#547

Open
jelmerdehen wants to merge 1 commit into
PixlOne:mainfrom
jelmerdehen:fix/adjustable-dpi-loop-oob
Open

fix(hidpp20): AdjustableDPI getSensorDPIList loop off-by-one#547
jelmerdehen wants to merge 1 commit into
PixlOne:mainfrom
jelmerdehen:fix/adjustable-dpi-loop-oob

Conversation

@jelmerdehen
Copy link
Copy Markdown

Summary

The loop in AdjustableDPI::getSensorDPIList:

for (std::size_t i = 1; i < response.size(); i += 2) {
    uint16_t dpi = response[i + 1];
    ...
}

bounds i against response.size() but reads response[i + 1]. Whenever response.size() is even (e.g. a Long response of 16 bytes), the final iteration reads one byte past the buffer.

Fix

Tighten the bound to i + 1 < response.size().

Test plan

  • Builds cleanly.
  • DPI list still parses correctly on a real adjustable-DPI mouse.

The loop bound 'i < response.size()' allowed i+1 to reach
response.size(), making 'response[i+1]' an out-of-bounds read whenever
response.size() was even. Tighten the bound to 'i + 1 < response.size()'.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant