Date: Mon, 16 Feb 2009 20:59:01 GMT From: Hans Petter Selasky <hselasky@FreeBSD.org> To: Perforce Change Reviews <perforce@FreeBSD.org> Subject: PERFORCE change 157814 for review Message-ID: <200902162059.n1GKx1S4018312@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=157814 Change 157814 by hselasky@hselasky_laptop001 on 2009/02/16 20:58:33 HID patch: The software computed HID size is not always correct, because the algoritm does not handle unsorted HID descriptors. TODO: Probably libusbhid has the same bug. This needs checking. Affected files ... .. //depot/projects/usb/src/sys/dev/usb2/core/usb2_hid.c#9 edit Differences ... ==== //depot/projects/usb/src/sys/dev/usb2/core/usb2_hid.c#9 (text+ko) ==== @@ -392,22 +392,38 @@ { struct hid_data *d; struct hid_item h; - int hi, lo, size, id; + uint32_t size; + uint32_t hi; + uint32_t lo; + uint8_t id; id = 0; - hi = lo = -1; + hi = 0; + lo = (uint32_t)(0-1); for (d = hid_start_parse(buf, len, 1 << k); hid_get_item(d, &h);) if (h.kind == k) { if (h.report_ID != 0 && !id) id = h.report_ID; if (h.report_ID == id) { - if (lo < 0) + /* check if "lo" is greater than "pos" */ + if (lo > h.loc.pos) lo = h.loc.pos; - hi = h.loc.pos + h.loc.size * h.loc.count; + /* compute end position */ + size = h.loc.pos + (h.loc.size * h.loc.count); + /* check if "size" wrapped */ + /* check if "hi" is less than "size" */ + if (size < h.loc.pos) + hi = (uint32_t)(0-1); + else if (hi < size) + hi = size; } } hid_end_parse(d); - size = hi - lo; + if (lo > hi) + size = 0; + else + size = hi - lo; + if (id != 0) { size += 8; *idp = id; /* XXX wrong */
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200902162059.n1GKx1S4018312>