svn commit: r358452 - stable/12/sys/dev/usb/input

[Hans Petter Selasky]

Author: hselasky
Date: Fri Feb 28 22:00:01 2020
New Revision: 358452
URL: https://svnweb.freebsd.org/changeset/base/358452

Log:
  MFC r358310:
  Use hid_get_data_unsigned() instead of hid_get_data() when reading the
  key-codes from the USB keyboard. Negative key-codes are currently skipped.
  
  While at it use the bit size value provided by the HID location structure
  instead of assuming a value of 8.
  
  This fixes a regression issue after r357861.
  
  Reported by:	Minoru TANABE <kotanabe3 at gmail.com>
  PR:	224592
  PR:	233884
  Sponsored by:	Mellanox Technologies

Modified:
  stable/12/sys/dev/usb/input/ukbd.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/dev/usb/input/ukbd.c
==============================================================================
--- stable/12/sys/dev/usb/input/ukbd.c	Fri Feb 28 21:42:48 2020	(r358451)
+++ stable/12/sys/dev/usb/input/ukbd.c	Fri Feb 28 22:00:01 2020	(r358452)
@@ -701,13 +701,15 @@ ukbd_intr_callback(struct usb_xfer *xfer, usb_error_t 
 			} else if (id != sc->sc_id_loc_key[i]) {
 				continue;	/* invalid HID ID */
 			} else if (i == 0) {
-				offset = sc->sc_loc_key[0].count;
-				if (offset < 0 || offset > len)
-					offset = len;
-				while (offset--) {
+				struct hid_location tmp_loc = sc->sc_loc_key[0];
+				/* range check array size */
+				if (tmp_loc.count > UKBD_NKEYCODE)
+					tmp_loc.count = UKBD_NKEYCODE;
+				while (tmp_loc.count--) {
 					uint32_t key =
-					    hid_get_data(sc->sc_buffer + offset, len - offset,
-					    &sc->sc_loc_key[i]);
+					    hid_get_data_unsigned(sc->sc_buffer, len, &tmp_loc);
+					/* advance to next location */
+					tmp_loc.pos += tmp_loc.size;
 					if (modifiers & MOD_FN)
 						key = ukbd_apple_fn(key);
 					if (sc->sc_flags & UKBD_FLAG_APPLE_SWAP)