From f7b517d8c2e09f8ebe0de4800b0c2555cfa33e82 Mon Sep 17 00:00:00 2001
From: Andrew Paseltiner <[email protected]>
Date: Mon, 11 May 2026 12:05:48 -0700
Subject: [PATCH] gamepad: Fix potential stack data leak in shared memory

This CL fixes a potential information leak where browser-process stack
data could be copied into shared memory accessible by the renderer.

1. Moved PadState constructor/destructor to the header as implicit
   defaults. This ensures that the constructor is not user-provided
   and is therefore value-initializable, so that structural padding is
   zeroed when initialized as PadState().
2. Explicitly value-initialized Gamepads buffers in
   GamepadProvider::DoPoll to ensure structural padding is zeroed.

Fixed: 501747804
Change-Id: I0e6e2dd4ff531e1c52d01a9c1504b1b0557965dd
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7832846
Reviewed-by: Rob Pitkin <[email protected]>
Commit-Queue: Andrew Paseltiner <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1628722}
---

diff --git a/device/gamepad/gamepad_pad_state_provider.cc b/device/gamepad/gamepad_pad_state_provider.cc
index 2dd97ee..0ffd228f 100644
--- a/device/gamepad/gamepad_pad_state_provider.cc
+++ b/device/gamepad/gamepad_pad_state_provider.cc
@@ -24,9 +24,6 @@
 
 }  // namespace
 
-PadState::PadState() = default;
-PadState::~PadState() = default;
-
 GamepadPadStateProvider::GamepadPadStateProvider() {
   pad_states_ = base::HeapArray<PadState>::WithSize(Gamepads::kItemsLengthCap);
 
diff --git a/device/gamepad/gamepad_pad_state_provider.h b/device/gamepad/gamepad_pad_state_provider.h
index ceacc7b5..915fe3a 100644
--- a/device/gamepad/gamepad_pad_state_provider.h
+++ b/device/gamepad/gamepad_pad_state_provider.h
@@ -46,10 +46,11 @@
   kMaxValue = kWinGameInput,
 };
 
+// PadState must not have a user-provided constructor so that it remains
+// value-initializable. This ensures that structural padding is zeroed when
+// initialized as `PadState()`, preventing information leaks of
+// browser-process stack memory (crbug.com/501747804).
 struct PadState {
-  PadState();
-  ~PadState();
-
   // Index of the slot occupied by this gamepad.
   int pad_index = 0;
 
diff --git a/device/gamepad/gamepad_provider.cc b/device/gamepad/gamepad_provider.cc
index 361651d..5e6de28 100644
--- a/device/gamepad/gamepad_provider.cc
+++ b/device/gamepad/gamepad_provider.cc
@@ -507,8 +507,9 @@
     it->GetGamepadData(changed);
   }
 
-  Gamepads old_buffer;
-  Gamepads new_buffer;
+  // Value-initialize to zero padding and prevent leaks (crbug.com/501747804).
+  Gamepads old_buffer = {};
+  Gamepads new_buffer = {};
   GetCurrentGamepadData(&old_buffer);
 
   for (size_t i = 0; i < Gamepads::kItemsLengthCap; ++i) {