From 87c27f4f274b7bf86da2ffdc01f567bdf17a73c1 Mon Sep 17 00:00:00 2001 From: Michael Lotz Date: Thu, 23 Apr 2015 22:19:17 +0200 Subject: [PATCH] usb_hid: Fix copy length of key state array. Twice the size was copied due to a missed adjustment in hrev31839, reading past the key state array. This didn't cause any corruption because the overwritten state wasn't used anymore later on and the write didn't overrun. It could cause a crash however if the read went past the allocated area. --- .../kernel/drivers/input/usb_hid/KeyboardProtocolHandler.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/add-ons/kernel/drivers/input/usb_hid/KeyboardProtocolHandler.cpp b/src/add-ons/kernel/drivers/input/usb_hid/KeyboardProtocolHandler.cpp index a30af96b3d..9824a6f7d2 100644 --- a/src/add-ons/kernel/drivers/input/usb_hid/KeyboardProtocolHandler.cpp +++ b/src/add-ons/kernel/drivers/input/usb_hid/KeyboardProtocolHandler.cpp @@ -771,6 +771,6 @@ KeyboardProtocolHandler::_ReadReport(bigtime_t timeout, uint32 *cookie) keyDown = true; } - memcpy(fLastKeys, fCurrentKeys, fKeyCount * sizeof(uint32)); + memcpy(fLastKeys, fCurrentKeys, fKeyCount * sizeof(uint16)); return B_OK; }