From 3edfe194381b36ae6bafde59cfb4597afafd731c Mon Sep 17 00:00:00 2001 From: Brandon Arrendondo Date: Wed, 24 Jun 2026 11:40:28 -0400 Subject: [PATCH] [rcore] Bounds-check gamepad index in GetGamepadAxisCount() and GetGamepadName() (#5937) * [rcore] Bounds-check gamepad index in GetGamepadAxisCount() and GetGamepadName() Both public getters indexed CORE.Input.Gamepad.axisCount[gamepad] / .name[gamepad] with an unvalidated gamepad argument -- an out-of-bounds read for gamepad < 0 or gamepad >= MAX_GAMEPADS. Every sibling gamepad accessor (IsGamepadAvailable, IsGamepadButton*, GetGamepadAxisMovement) already guards the index; add the same check, returning a safe default (0 / NULL). * Refactor GetGamepadName/GetGamepadAxisCount to single-return pattern --------- Co-authored-by: Brandon Arrendondo --- src/rcore.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/rcore.c b/src/rcore.c index 7455e3597..12de4141e 100644 --- a/src/rcore.c +++ b/src/rcore.c @@ -3934,7 +3934,11 @@ bool IsGamepadAvailable(int gamepad) // Get gamepad internal name id const char *GetGamepadName(int gamepad) { - return CORE.Input.Gamepad.name[gamepad]; + const char *name = NULL; + + if ((gamepad >= 0) && (gamepad < MAX_GAMEPADS)) name = CORE.Input.Gamepad.name[gamepad]; + + return name; } // Check if gamepad button has been pressed once @@ -3999,7 +4003,11 @@ int GetGamepadButtonPressed(void) // Get gamepad axis count int GetGamepadAxisCount(int gamepad) { - return CORE.Input.Gamepad.axisCount[gamepad]; + int result = 0; + + if ((gamepad >= 0) && (gamepad < MAX_GAMEPADS)) result = CORE.Input.Gamepad.axisCount[gamepad]; + + return result; } // Get axis movement vector for a gamepad