From 26bebb13a12d2ff89380e41ecae676a106675f67 Mon Sep 17 00:00:00 2001
From: Michael Lotz <mmlr@mlotz.ch>
Date: Thu, 23 Apr 2015 22:34:07 +0200
Subject: [PATCH] usb_hid: Avoid read/writing past allocations with report
 items.

When extracting/inserting report items there might not be a full uint32
available in the report anymore. Only copy as many bytes as are actually
needed by the report item and guaranteed to be present in the report.
---
 src/add-ons/kernel/drivers/input/usb_hid/HIDReportItem.cpp | 7 ++++---
 src/add-ons/kernel/drivers/input/usb_hid/HIDReportItem.h   | 1 +
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/add-ons/kernel/drivers/input/usb_hid/HIDReportItem.cpp b/src/add-ons/kernel/drivers/input/usb_hid/HIDReportItem.cpp
index 76faca711d..8bb5c51c1b 100644
--- a/src/add-ons/kernel/drivers/input/usb_hid/HIDReportItem.cpp
+++ b/src/add-ons/kernel/drivers/input/usb_hid/HIDReportItem.cpp
@@ -22,6 +22,7 @@ HIDReportItem::HIDReportItem(HIDReport *report, uint32 bitOffset,
 		fShift(bitOffset % 8),
 		fMask(~(0xffffffff << bitLength)),
 		fBitCount(bitLength),
+		fByteCount((fShift + fBitCount + 7) / 8),
 		fHasData(hasData),
 		fArray(isArray),
 		fRelative(isRelative),
@@ -63,7 +64,7 @@ HIDReportItem::Extract()
 	if (report == NULL)
 		return B_NO_INIT;
 
-	memcpy(&fData, report + fByteOffset, sizeof(uint32));
+	memcpy(&fData, report + fByteOffset, fByteCount);
 	fData >>= fShift;
 	fData &= fMask;
 
@@ -89,13 +90,13 @@ HIDReportItem::Insert()
 		return B_NO_INIT;
 
 	uint32 value;
-	memcpy(&value, report + fByteOffset, sizeof(uint32));
+	memcpy(&value, report + fByteOffset, fByteCount);
 	value &= ~(fMask << fShift);
 
 	if (fValid)
 		value |= (fData & fMask) << fShift;
 
-	memcpy(report + fByteOffset, &value, sizeof(uint32));
+	memcpy(report + fByteOffset, &value, fByteCount);
 	return B_OK;
 }
 
diff --git a/src/add-ons/kernel/drivers/input/usb_hid/HIDReportItem.h b/src/add-ons/kernel/drivers/input/usb_hid/HIDReportItem.h
index b9f4e1f0c0..2ee27341c8 100644
--- a/src/add-ons/kernel/drivers/input/usb_hid/HIDReportItem.h
+++ b/src/add-ons/kernel/drivers/input/usb_hid/HIDReportItem.h
@@ -49,6 +49,7 @@ private:
 		uint8					fShift;
 		uint32					fMask;
 		uint8					fBitCount;
+		uint8					fByteCount;
 		bool					fHasData;
 		bool					fArray;
 		bool					fRelative;