mirror of
https://github.com/libretro/RetroArch.git
synced 2026-11-10 11:31:41 -10:00
A nearby Bluetooth name can contain a newline that forges a line in bluetoothctl devices output. The next status check or a connect action used the forged line's second token in a popen() command, allowing shell commands to run as the RetroArch user. Accept only lines with a valid Bluetooth address, use that address for status, connect, and remove commands, and cap the list to the fixed status arrays.