From 21373d8c4a901ad5cc1cb36fe6e631db9f9d0a9d Mon Sep 17 00:00:00 2001 From: Yaroslav Chvanov Date: Tue, 12 Dec 2023 02:17:07 +0300 Subject: [PATCH] sinowealth: fix lift-off distance reading integer overflow Add same safety checks for it and angle snapping setting living near it. Also log if something else is found in those buffers. --- src/driver-sinowealth.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/src/driver-sinowealth.c b/src/driver-sinowealth.c index b604f639..8d57efb2 100644 --- a/src/driver-sinowealth.c +++ b/src/driver-sinowealth.c @@ -1114,8 +1114,14 @@ sinowealth_print_long_lod_and_anglesnapping(struct ratbag_device *device) int rc = 0; /* TODO: implement angle snapping and lift-off distance changing once we have an API for that. - * To implement LOD changing here: set the third index to + 1. - * To implement angle snapping toggling here: set the fourth index to 1 or 0 to enable or disable accordingly. + * + * To implement LOD changing here: set the second to last bit of buf[2] + * to . + * TODO: what does the last bit in buf[2] mean? It was 0 on Fantech + * Helios UX3 V2, but IIRC always 1 on G-Wolves Hati. + * + * To implement angle snapping toggling here: set last bit of buf[3] to + * 1 or 0 to enable or disable accordingly. */ uint8_t buf[SINOWEALTH_CMD_SIZE] = { SINOWEALTH_REPORT_ID_CMD, SINOWEALTH_CMD_LONG_ANGLESNAPPING_AND_LOD }; @@ -1127,8 +1133,16 @@ sinowealth_print_long_lod_and_anglesnapping(struct ratbag_device *device) return rc; } - log_info(device->ratbag, "Lift-off distance is high: %u\n", buf[2] - 1); - log_info(device->ratbag, "Angle snapping enabled: %u\n", buf[3]); + log_info(device->ratbag, "Lift-off distance: %s\n", buf[2] & 0b10 ? "high" : "low"); + log_info(device->ratbag, "buf[2] unknown bit: %u\n", buf[2] & 0b1); + if ((buf[2] & ~0b11) != 0) { + log_info(device->ratbag, "buf[2] also has something else, full raw value: %u\n", buf[2]); + } + + log_info(device->ratbag, "Angle snapping: %s\n", buf[3] & 0b1 ? "on" : "off"); + if ((buf[1] & ~0b1) != 0) { + log_info(device->ratbag, "buf[3] also has something else, full raw value: %u\n", buf[3]); + } return 0; }