DragonFlyBSD Kernel Audit
DF-2338 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/bus/u4b/input/wsp.c b/sys/bus/u4b/input/wsp.c
--- a/sys/bus/u4b/input/wsp.c
+++ b/sys/bus/u4b/input/wsp.c
@@ -920,6 +920,21 @@
 			sc->index[i] = f;
 		}
 
+		/*
+		 * No fingers this report: index[] was never populated (and for TYPE1
+		 * ntouch is always 0). Skip the tap/distance/untouch logic that
+		 * dereferences sc->index[0..] to avoid a NULL-deref panic.
+		 */
+		if (ntouch == 0) {
+			sc->sc_status.flags &= ~MOUSE_POSCHANGED;
+			sc->sc_status.flags &= ~MOUSE_STDBUTTONSCHANGED;
+			sc->sc_status.obutton = sc->sc_status.button;
+			sc->sc_status.button = 0;
+			if (sc->sc_touch == WSP_TOUCHING)
+				sc->sc_touch = WSP_UNTOUCH;
+			goto tr_setup;
+		}
+
 		sc->sc_status.flags &= ~MOUSE_POSCHANGED;
 		sc->sc_status.flags &= ~MOUSE_STDBUTTONSCHANGED;
 		sc->sc_status.obutton = sc->sc_status.button;