[src/trunk]: src/lib/libusbhid hid_get_data() will read an extra byte if the ...

[plunky <plunky%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/64744b67b0fe
branches:  trunk
changeset: 754790:64744b67b0fe
user:      plunky <plunky%NetBSD.org@localhost>
date:      Wed May 12 18:28:20 2010 +0000

description:
hid_get_data() will read an extra byte if the data being read ends on
a byte boundary. This byte is subsequently discarded, but it could be
a byte from memory after the end of the report being parsed.

Fix this by rounding up and ending the loop one earlier.

diffstat:

 lib/libusbhid/data.c |  8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diffs (30 lines):

diff -r 78c85005d47d -r 64744b67b0fe lib/libusbhid/data.c
--- a/lib/libusbhid/data.c      Wed May 12 18:22:36 2010 +0000
+++ b/lib/libusbhid/data.c      Wed May 12 18:28:20 2010 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: data.c,v 1.5 2005/12/14 17:35:40 wiz Exp $     */
+/*     $NetBSD: data.c,v 1.6 2010/05/12 18:28:20 plunky Exp $  */
 
 /*
  * Copyright (c) 1999 Lennart Augustsson <augustss%NetBSD.org@localhost>
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__RCSID("$NetBSD: data.c,v 1.5 2005/12/14 17:35:40 wiz Exp $");
+__RCSID("$NetBSD: data.c,v 1.6 2010/05/12 18:28:20 plunky Exp $");
 
 #include <assert.h>
 #include <stdlib.h>
@@ -52,9 +52,9 @@
        if (hsize == 0)
                return (0);
        offs = hpos / 8;
-       end = (hpos + hsize) / 8 - offs;
+       end = (hpos + hsize + 7) / 8 - offs;
        data = 0;
-       for (i = 0; i <= end; i++)
+       for (i = 0; i < end; i++)
                data |= buf[offs + i] << (i*8);
        data >>= hpos % 8;
        data &= (1 << hsize) - 1;