From b67a5b4cd84e7259abd3049620efb947abadda39 Mon Sep 17 00:00:00 2001
From: nanahi <130121847+na-na-hi@users.noreply.github.com>
Date: Mon, 30 Mar 2026 20:25:26 -0400
Subject: [PATCH] input: fix out of bound read/write in pad_buttons_pressed

When buttons > MP_MAX_TABLET_PAD_BUTTONS and the value is stored in
ictx->tablet_pad_buttons, the next mp_input_set_tablet_pad_focus call
will cause out of bound write, and mp_property_tablet_pos will cause
out of bound read.

Fix this by limiting ictx->tablet_pad_buttons range.

Fixes: 0fbf20f05701cf04256dd3be3d8112099843fb43
---
 input/input.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/input/input.c b/input/input.c
index d1db4d4a00..e99180eff7 100644
--- a/input/input.c
+++ b/input/input.c
@@ -1179,7 +1179,7 @@ void mp_input_set_tablet_pad_focus(struct input_ctx *ictx, bool focus, int butto
         for (int i = 0; i < ictx->tablet_pad_buttons; i++)
             ictx->tablet_pad_buttons_pressed[i] = false;
     }
-    ictx->tablet_pad_buttons = buttons;
+    ictx->tablet_pad_buttons = MPMIN(buttons, MP_MAX_TABLET_PAD_BUTTONS);
     notify_tablet_update(ictx);
     input_unlock(ictx);
 }