Module Name: src
Committed By: plunky
Date: Wed May 12 18:28:20 UTC 2010
Modified Files:
src/lib/libusbhid: data.c
Log Message:
hid_get_data() will read an extra byte if the data being read ends on
a byte boundary. This byte is subsequently discarded, but it could be
a byte from memory after the end of the report being parsed.
Fix this by rounding up and ending the loop one earlier.
To generate a diff of this commit:
cvs rdiff -u -r1.5 -r1.6 src/lib/libusbhid/data.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/lib/libusbhid/data.c
diff -u src/lib/libusbhid/data.c:1.5 src/lib/libusbhid/data.c:1.6
--- src/lib/libusbhid/data.c:1.5 Wed Dec 14 17:35:40 2005
+++ src/lib/libusbhid/data.c Wed May 12 18:28:20 2010
@@ -1,4 +1,4 @@
-/* $NetBSD: data.c,v 1.5 2005/12/14 17:35:40 wiz Exp $ */
+/* $NetBSD: data.c,v 1.6 2010/05/12 18:28:20 plunky Exp $ */
/*
* Copyright (c) 1999 Lennart Augustsson <augus...@netbsd.org>
@@ -27,7 +27,7 @@
*/
#include <sys/cdefs.h>
-__RCSID("$NetBSD: data.c,v 1.5 2005/12/14 17:35:40 wiz Exp $");
+__RCSID("$NetBSD: data.c,v 1.6 2010/05/12 18:28:20 plunky Exp $");
#include <assert.h>
#include <stdlib.h>
@@ -52,9 +52,9 @@
if (hsize == 0)
return (0);
offs = hpos / 8;
- end = (hpos + hsize) / 8 - offs;
+ end = (hpos + hsize + 7) / 8 - offs;
data = 0;
- for (i = 0; i <= end; i++)
+ for (i = 0; i < end; i++)
data |= buf[offs + i] << (i*8);
data >>= hpos % 8;
data &= (1 << hsize) - 1;
