mirror of
https://github.com/libretro/RetroArch.git
synced 2026-11-07 08:36:02 -10:00
A nearby Bluetooth name can contain a newline that forges a line in bluetoothctl devices output. The next status check or a connect action used the forged line's second token in a popen() command, allowing shell commands to run as the RetroArch user. Accept only lines with a valid Bluetooth address, use that address for status, connect, and remove commands, and cap the list to the fixed status arrays.