Firefox · DOM
CVE-2026-6764
Logic Error in DOM
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/gamepad/GamepadRemapping.cpp |
modified |
Files Changed
dom/gamepad/GamepadRemapping.cppdom/gamepad/GamepadRemapping.hdom/gamepad/cocoa/CocoaGamepad.cppdom/gamepad/windows/WindowsGamepad.cpp
Patch
diff --git a/dom/gamepad/GamepadRemapping.cpp b/dom/gamepad/GamepadRemapping.cpp
index e76648e34dd..50d43d53646 100644
--- a/dom/gamepad/GamepadRemapping.cpp
+++ b/dom/gamepad/GamepadRemapping.cpp
@@ -476,10 +476,16 @@ class Dualshock4Remapper final : public GamepadRemapper {
return MAX_INPUT_LEN;
}
- virtual void ProcessTouchData(GamepadHandle aHandle, void* aInput) override {
+ static constexpr size_t kMinTouchReportLen = 43;
+
+ virtual void ProcessTouchData(GamepadHandle aHandle, const uint8_t* aInput,
+ size_t aInputLen) override {
+ if (aInputLen < kMinTouchReportLen) {
+ return;
+ }
nsTArray<GamepadTouchState> touches(TOUCH_EVENT_COUNT);
touches.SetLength(TOUCH_EVENT_COUNT);
- uint8_t* rawData = (uint8_t*)aInput;
+ const uint8_t* rawData = aInput;
const uint32_t kTouchDimensionX = 1920;
const uint32_t kTouchDimensionY = 942;
diff --git a/dom/gamepad/GamepadRemapping.h b/dom/gamepad/GamepadRemapping.h
index d0be22a30c1..7e0d3182832 100644
--- a/dom/gamepad/GamepadRemapping.h
+++ b/dom/gamepad/GamepadRemapping.h
@@ -150,7 +150,8 @@ class GamepadRemapper {
virtual GamepadMappingType GetMappingType() const {
return GamepadMappingType::Standard;
}
- virtual void ProcessTouchData(GamepadHandle aHandle, void* aInput) {}
+ virtual void ProcessTouchData(GamepadHandle aHandle, const uint8_t* aInput,
+ size_t aInputLen) {}
virtual void RemapAxisMoveEvent(GamepadHandle aHandle, uint32_t aAxis,
double aValue) const = 0;
virtual void RemapButtonEvent(GamepadHandle aHandle, uint32_t aButton,
diff --git a/dom/gamepad/cocoa/CocoaGamepad.cpp b/dom/gamepad/cocoa/CocoaGamepad.cpp
index 34f3bc822f8..c479a2c8233 100644
--- a/dom/gamepad/cocoa/CocoaGamepad.cpp
+++ b/dom/gamepad/cocoa/CocoaGamepad.cpp
@@ -397,7 +397,7 @@ void DarwinGamepadService::ReportChangedCallback(
void Gamepad::ReportChanged(uint8_t* report, CFIndex report_len) {
MOZ_RELEASE_ASSERT(report_len <= mRemapper->GetMaxInputReportLength());
- mRemapper->ProcessTouchData(mHandle, report);
+ mRemapper->ProcessTouchData(mHandle, report, report_len);
}
size_t Gamepad::WriteOutputReport(const std::vector<uint8_t>& aReport) const {
diff --git a/dom/gamepad/windows/WindowsGamepad.cpp b/dom/gamepad/windows/WindowsGamepad.cpp
index 92951bff0d9..1a52235ed7d 100644
--- a/dom/gamepad/windows/WindowsGamepad.cpp
+++ b/dom/gamepad/windows/WindowsGamepad.cpp
@@ -880,8 +880,8 @@ bool WindowsGamepadService::HandleRawInput(HRAWINPUT handle) {
}
}
- BYTE* rawData = raw->data.hid.bRawData;
- gamepad->remapper->ProcessTouchData(gamepad->gamepadHandle, rawData);
+ gamepad->remapper->ProcessTouchData(
+ gamepad->gamepadHandle, raw->data.hid.bRawData, raw->data.hid.dwSizeHid);
return true;
}
Loading diff…
References
On This Page