Skip to content

Fix undefined behaviour and error handling in the HidModifier config path #81

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nutbolt9 wants to merge 3 commits into
base: main
Choose a base branch
from
+25 −13
Open

Fix undefined behaviour and error handling in the HidModifier config path #81

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b34102f
Fall back to unmodified lighthouse config when recompression fails
nutbolt9 Aug 1, 2026
e450067
Initialise HidDeviceInfo members
nutbolt9 Aug 1, 2026
03cb3a1
Guard HidGetFeatureReportHook against short buffers
nutbolt9 Aug 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 16 additions & 9 deletions CustomHeadsetOpenVR/src/Driver/HidModifier.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -325,16 +325,20 @@ std::string HidModifier::ReadLighthouseConfig(HidDeviceInfo &info){
result = compress(configRecompressed, &recompressedSize, (unsigned char*)newConfigStr.c_str(), newConfigStr.length());
if(result == Z_OK){
DriverLog("Recompressed lighthouse config");
// not sure why but these are always returned
configRecompressed[recompressedSize] = 0xff;
configRecompressed[recompressedSize + 1] = 0xff;
info.newLighthouseConfig = configRecompressed;
info.newLighthouseConfigLength = recompressedSize;
// info.newLighthouseConfig = configCompressed;
// info.newLighthouseConfigLength = size;
}else{
DriverLog("Failed to recompress lighthouse config");
// Serving a partially written buffer makes the lighthouse driver parse a corrupt
// config. Leave newLighthouseConfig null so HidGetFeatureReportHook falls through
// to the device's own unmodified config instead.
DriverLog("Failed to recompress lighthouse config, falling back to unmodified config");
delete[] configRecompressed;
}
// not sure why but these are always returned
configRecompressed[recompressedSize] = 0xff;
configRecompressed[recompressedSize + 1] = 0xff;
info.newLighthouseConfig = configRecompressed;
info.newLighthouseConfigLength = recompressedSize;
// info.newLighthouseConfig = configCompressed;
// info.newLighthouseConfigLength = size;
}

return configStr;
Expand Down Expand Up @@ -367,7 +371,10 @@ int HidModifier::HidGetFeatureReportHook(hid_device* device, unsigned char* data
#endif

HidDeviceInfo &info = hidModifier.deviceMap[device];
if(info.newLighthouseConfig != nullptr){
// Both branches below read data[0] and write data[1], and the 0x10 branch also writes
// data[2]. length is a size_t, so a caller passing less than 2 would also underflow the
// (length - 2) that sizes the chunk copy, yielding a negative toCopy and a huge memcpy.
if(info.newLighthouseConfig != nullptr && length >= 3){
// output the new config
if(data[0] == 0x10){
// output new size
Expand Down
13 changes: 9 additions & 4 deletions CustomHeadsetOpenVR/src/Driver/HidModifier.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,13 +64,18 @@ class HidModifier {
// info about device
class HidDeviceInfo {
public:
hid_device* device;
// These must be initialised here. AddDevice default-initialises a HidDeviceInfo and
// ReadLighthouseConfig only assigns newLighthouseConfig when it modifies the config,
// so every early return (failed feature report, oversized config, failed decompress)
// would otherwise leave an indeterminate pointer that HidGetFeatureReportHook tests
// against nullptr and Delete() passes to delete[].
hid_device* device = nullptr;
std::string lighthouseDeviceName;
std::string lighthouseDeviceManufacturer;
// std::string lighthouseConfig;
unsigned char* newLighthouseConfig;
int newLighthouseConfigLength;
int newLighthouseConfigOffset;
unsigned char* newLighthouseConfig = nullptr;
int newLighthouseConfigLength = 0;
int newLighthouseConfigOffset = 0;
void Delete(){
if(newLighthouseConfig) {
delete[] newLighthouseConfig;
Expand Down