From 6045f3d3e9a8e8607e7906e0e0699439fbb2d0de Mon Sep 17 00:00:00 2001
From: Jelmer de Hen <18084450+jelmerdehen@users.noreply.github.com>
Date: Sun, 26 Apr 2026 04:04:02 +0200
Subject: [PATCH] fix(hidpp20): AdjustableDPI getSensorDPIList loop off-by-one

The loop bound 'i < response.size()' allowed i+1 to reach
response.size(), making 'response[i+1]' an out-of-bounds read whenever
response.size() was even. Tighten the bound to 'i + 1 < response.size()'.
---
 src/logid/backend/hidpp20/features/AdjustableDPI.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/logid/backend/hidpp20/features/AdjustableDPI.cpp b/src/logid/backend/hidpp20/features/AdjustableDPI.cpp
index 15dcd2bc..7d2c239a 100644
--- a/src/logid/backend/hidpp20/features/AdjustableDPI.cpp
+++ b/src/logid/backend/hidpp20/features/AdjustableDPI.cpp
@@ -35,7 +35,7 @@ AdjustableDPI::SensorDPIList AdjustableDPI::getSensorDPIList(uint8_t sensor) {
     auto response = callFunction(GetSensorDPIList, params);
 
     dpi_list.dpiStep = false;
-    for (std::size_t i = 1; i < response.size(); i += 2) {
+    for (std::size_t i = 1; i + 1 < response.size(); i += 2) {
         uint16_t dpi = response[i + 1];
         dpi |= (response[i] << 8);
         if (!dpi)