From bf2a0fb8f1891ea508f0aa74179762c621a2f52b Mon Sep 17 00:00:00 2001 From: Ken Sanislo Date: Tue, 1 Sep 2026 23:05:36 -0700 Subject: [PATCH] HID LampArray: stop on a failed report descriptor read hid_get_report_descriptor returns -1 on failure and the length was stored unsigned, so the descriptor walk ran past the end of the stack buffer. Windows reconstructs the descriptor from preparsed data and can fail where Linux returns the kernel's copy. A failed read now leaves the device with no lamps, the same as a descriptor with missing reports. --- .../HIDLampArrayController.cpp | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/Controllers/HIDLampArrayController/HIDLampArrayController.cpp b/Controllers/HIDLampArrayController/HIDLampArrayController.cpp index 694ce1100..eacd713c1 100644 --- a/Controllers/HIDLampArrayController/HIDLampArrayController.cpp +++ b/Controllers/HIDLampArrayController/HIDLampArrayController.cpp @@ -31,7 +31,7 @@ HIDLampArrayController::HIDLampArrayController(hid_device *dev_handle, const cha unsigned int pos = 0; unsigned char report_descriptor[HID_API_MAX_REPORT_DESCRIPTOR_SIZE]; unsigned char report_id = 0; - unsigned int size = hid_get_report_descriptor(dev, report_descriptor, sizeof(report_descriptor)); + int size = hid_get_report_descriptor(dev, report_descriptor, sizeof(report_descriptor)); unsigned int usage = 0; unsigned char usage_page = 0; @@ -40,7 +40,18 @@ HIDLampArrayController::HIDLampArrayController(hid_device *dev_handle, const cha \*-----------------------------------------------------*/ std::unordered_map usage_to_report_id; - while(pos < size) + /*-----------------------------------------------------*\ + | A failed descriptor read returns -1; treated as a | + | length it walks off the end of the buffer. | + \*-----------------------------------------------------*/ + if(size < 0) + { + LampArray.LampCount = 0; + LampArray.LampArrayKind = HID_LAMPARRAY_KIND_UNDEFINED; + return; + } + + while(pos < (unsigned int)size) { get_hid_item_size(report_descriptor, size, pos, &data_len, &key_size);