steam-frame/lbgos--rift-s-linux
1
0 Fork 0
mirror of https://github.com/lbgos/rift-s-linux.git synced 2026-10-24 16:01:44 +02:00
Code Issues Packages Projects Releases 6 Wiki Activity

constellation: fail closed when a model exceeds MAX_OBJECT_LEDS

Browse Source 
project_led_points() and project_bounding_points() write into
caller stack arrays sized MAX_OBJECT_LEDS (64) but looped over the
model's uint8_t counts unchecked. Reject oversized models instead
of overflowing the stack.
This commit is contained in:
lbgos committed 2026-10-13 00:31:49 +03:00
1 parent 76f4fd6204
commit bf0a04c036
1 file changed
+8
Download Patch File Download Diff File Expand all files Collapse all files
src/xrt/tracking/constellation/internal/pose_metrics.c
+8
View File
@@ -141,6 +141,10 @@ project_led_points(struct t_constellation_led_model *led_model,
struct xrt_vec3 *out_positions,
struct xrt_vec2 *out_points)
{
/* Callers pass MAX_OBJECT_LEDS-sized stack arrays; fail closed. */
if (led_model->num_leds > MAX_OBJECT_LEDS) {
return false;
}
for (int i = 0; i < led_model->num_leds; i++) {
struct xrt_vec3 *tmp = out_positions + i;
math_pose_transform_point(pose, &led_model->leds[i].pos, tmp);
@@ -270,6 +274,10 @@ project_bounding_points(struct t_constellation_led_model *led_model,
struct xrt_vec3 *out_positions,
struct xrt_vec2 *out_points)
{
/* Callers pass MAX_OBJECT_LEDS-sized stack arrays; fail closed. */
if (led_model->num_bounding_points > MAX_OBJECT_LEDS) {
return false;
}
for (int i = 0; i < led_model->num_bounding_points; i++) {
struct xrt_vec3 *tmp = out_positions + i;
math_pose_transform_point(P_cam_obj, &led_model->bounding_points[i].pos, tmp);