Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionIncorrect boundary conditions in the DOM: Device Interfaces component
ComponentDOM
Bug ClassLogic Error
Tracker2022162
Fix commit3b0f0e44383b (firefox) +13/-6
CISA KEVNot listed
CreditedFlorian
Disclosed2026-04-21

Changed Functions

FunctionChangeNotes
if
dom/gamepad/GamepadRemapping.cpp
modified

Files Changed

  • dom/gamepad/GamepadRemapping.cpp
  • dom/gamepad/GamepadRemapping.h
  • dom/gamepad/cocoa/CocoaGamepad.cpp
  • dom/gamepad/windows/WindowsGamepad.cpp
diff --git a/dom/gamepad/GamepadRemapping.cpp b/dom/gamepad/GamepadRemapping.cpp
index e76648e34dd..50d43d53646 100644
--- a/dom/gamepad/GamepadRemapping.cpp
+++ b/dom/gamepad/GamepadRemapping.cpp
@@ -476,10 +476,16 @@ class Dualshock4Remapper final : public GamepadRemapper {
     return MAX_INPUT_LEN;
   }
 
-  virtual void ProcessTouchData(GamepadHandle aHandle, void* aInput) override {
+  static constexpr size_t kMinTouchReportLen = 43;
+
+  virtual void ProcessTouchData(GamepadHandle aHandle, const uint8_t* aInput,
+                                size_t aInputLen) override {
+    if (aInputLen < kMinTouchReportLen) {
+      return;
+    }
     nsTArray<GamepadTouchState> touches(TOUCH_EVENT_COUNT);
     touches.SetLength(TOUCH_EVENT_COUNT);
-    uint8_t* rawData = (uint8_t*)aInput;
+    const uint8_t* rawData = aInput;
 
     const uint32_t kTouchDimensionX = 1920;
     const uint32_t kTouchDimensionY = 942;
diff --git a/dom/gamepad/GamepadRemapping.h b/dom/gamepad/GamepadRemapping.h
index d0be22a30c1..7e0d3182832 100644
--- a/dom/gamepad/GamepadRemapping.h
+++ b/dom/gamepad/GamepadRemapping.h
@@ -150,7 +150,8 @@ class GamepadRemapper {
   virtual GamepadMappingType GetMappingType() const {
     return GamepadMappingType::Standard;
   }
-  virtual void ProcessTouchData(GamepadHandle aHandle, void* aInput) {}
+  virtual void ProcessTouchData(GamepadHandle aHandle, const uint8_t* aInput,
+                                size_t aInputLen) {}
   virtual void RemapAxisMoveEvent(GamepadHandle aHandle, uint32_t aAxis,
                                   double aValue) const = 0;
   virtual void RemapButtonEvent(GamepadHandle aHandle, uint32_t aButton,
diff --git a/dom/gamepad/cocoa/CocoaGamepad.cpp b/dom/gamepad/cocoa/CocoaGamepad.cpp
index 34f3bc822f8..c479a2c8233 100644
--- a/dom/gamepad/cocoa/CocoaGamepad.cpp
+++ b/dom/gamepad/cocoa/CocoaGamepad.cpp
@@ -397,7 +397,7 @@ void DarwinGamepadService::ReportChangedCallback(
 
 void Gamepad::ReportChanged(uint8_t* report, CFIndex report_len) {
   MOZ_RELEASE_ASSERT(report_len <= mRemapper->GetMaxInputReportLength());
-  mRemapper->ProcessTouchData(mHandle, report);
+  mRemapper->ProcessTouchData(mHandle, report, report_len);
 }
 
 size_t Gamepad::WriteOutputReport(const std::vector<uint8_t>& aReport) const {
diff --git a/dom/gamepad/windows/WindowsGamepad.cpp b/dom/gamepad/windows/WindowsGamepad.cpp
index 92951bff0d9..1a52235ed7d 100644
--- a/dom/gamepad/windows/WindowsGamepad.cpp
+++ b/dom/gamepad/windows/WindowsGamepad.cpp
@@ -880,8 +880,8 @@ bool WindowsGamepadService::HandleRawInput(HRAWINPUT handle) {
     }
   }
 
-  BYTE* rawData = raw->data.hid.bRawData;
-  gamepad->remapper->ProcessTouchData(gamepad->gamepadHandle, rawData);
+  gamepad->remapper->ProcessTouchData(
+      gamepad->gamepadHandle, raw->data.hid.bRawData, raw->data.hid.dwSizeHid);
 
   return true;
 }
Loading diff…