DF-2338 / fix.diff
diff --git a/sys/bus/u4b/input/wsp.c b/sys/bus/u4b/input/wsp.c --- a/sys/bus/u4b/input/wsp.c +++ b/sys/bus/u4b/input/wsp.c @@ -920,6 +920,21 @@ sc->index[i] = f; } + /* + * No fingers this report: index[] was never populated (and for TYPE1 + * ntouch is always 0). Skip the tap/distance/untouch logic that + * dereferences sc->index[0..] to avoid a NULL-deref panic. + */ + if (ntouch == 0) { + sc->sc_status.flags &= ~MOUSE_POSCHANGED; + sc->sc_status.flags &= ~MOUSE_STDBUTTONSCHANGED; + sc->sc_status.obutton = sc->sc_status.button; + sc->sc_status.button = 0; + if (sc->sc_touch == WSP_TOUCHING) + sc->sc_touch = WSP_UNTOUCH; + goto tr_setup; + } + sc->sc_status.flags &= ~MOUSE_POSCHANGED; sc->sc_status.flags &= ~MOUSE_STDBUTTONSCHANGED; sc->sc_status.obutton = sc->sc_status.button; |