svn commit: r358310 - head/sys/dev/usb/input

[Hans Petter Selasky]

Author: hselasky
Date: Tue Feb 25 12:56:06 2020
New Revision: 358310
URL: https://svnweb.freebsd.org/changeset/base/358310

Log:
  Use hid_get_data_unsigned() instead of hid_get_data() when reading the
  key-codes from the USB keyboard. Negative key-codes are currently skipped.
  
  While at it use the bit size value provided by the HID location structure
  instead of assuming a value of 8.
  
  This fixes a regression issue after r357861.
  
  Reported by:	Minoru TANABE <kotanabe3 at gmail.com>
  PR:	224592
  PR:	233884
  MFC after:	3 days
  Sponsored by:	Mellanox Technologies

Modified:
  head/sys/dev/usb/input/ukbd.c

Modified: head/sys/dev/usb/input/ukbd.c
==============================================================================
--- head/sys/dev/usb/input/ukbd.c	Tue Feb 25 11:56:54 2020	(r358309)
+++ head/sys/dev/usb/input/ukbd.c	Tue Feb 25 12:56:06 2020	(r358310)
@@ -702,13 +702,15 @@ ukbd_intr_callback(struct usb_xfer *xfer, usb_error_t 
 			} else if (id != sc->sc_id_loc_key[i]) {
 				continue;	/* invalid HID ID */
 			} else if (i == 0) {
-				offset = sc->sc_loc_key[0].count;
-				if (offset < 0 || offset > len)
-					offset = len;
-				while (offset--) {
+				struct hid_location tmp_loc = sc->sc_loc_key[0];
+				/* range check array size */
+				if (tmp_loc.count > UKBD_NKEYCODE)
+					tmp_loc.count = UKBD_NKEYCODE;
+				while (tmp_loc.count--) {
 					uint32_t key =
-					    hid_get_data(sc->sc_buffer + offset, len - offset,
-					    &sc->sc_loc_key[i]);
+					    hid_get_data_unsigned(sc->sc_buffer, len, &tmp_loc);
+					/* advance to next location */
+					tmp_loc.pos += tmp_loc.size;
 					if (modifiers & MOD_FN)
 						key = ukbd_apple_fn(key);
 					if (sc->sc_flags & UKBD_FLAG_APPLE_SWAP)