Home | History | Annotate | Download | only in libusbhid
History log of /src/lib/libusbhid/data.c
RevisionDateAuthorComments
 1.9  04-Apr-2020  fox lib/libusbhid: Fix possible left shift changes signedness bit.

This bug was reported by UBSan runs.

lib/libusbhid/data.c:58:25
lib/libusbhid/data.c:91:7
lib/libusbhid/data.c:92:7

Can result in left shift changes signedness bit as a side effect positive number
can go negative, cast it to unsigned for the operation and silence the issue.

Reviewed by: kamil@
 1.8  07-Jan-2016  jakllsch branches: 1.8.16;
Fix buffer-overrun/off-by-one in hid_set_data(3).

(The tests only detected this as a problem on ARMv7, not i386.)
 1.7  01-Jan-2016  jakllsch Fix hid_get_data() for negative or 32-bit report data.
 1.6  12-May-2010  plunky hid_get_data() will read an extra byte if the data being read ends on
a byte boundary. This byte is subsequently discarded, but it could be
a byte from memory after the end of the report being parsed.

Fix this by rounding up and ending the loop one earlier.
 1.5  14-Dec-2005  wiz branches: 1.5.4; 1.5.26;
Fix sign extension broken by previous. dillo hacked here too.
 1.4  05-Dec-2005  christos fix non-portable right shifts.
 1.3  26-Jul-2003  salo netbsd.org->NetBSD.org
 1.2  08-Mar-2003  lukem add RCSID
 1.1  28-Dec-2001  augustss Update for uhidev(4) changes.
Also rename libusb to libusbhid (which is a much better name).
 1.5.26.1  21-Nov-2010  riz Pull up following revision(s) (requested by plunky in ticket #1398):
lib/libusbhid/data.c: revision 1.6
hid_get_data() will read an extra byte if the data being read ends on
a byte boundary. This byte is subsequently discarded, but it could be
a byte from memory after the end of the report being parsed.
Fix this by rounding up and ending the loop one earlier.
 1.5.4.1  13-Jun-2010  riz Pull up following revision(s) (requested by plunky in ticket #1394):
lib/libusbhid/data.c: revision 1.6
hid_get_data() will read an extra byte if the data being read ends on
a byte boundary. This byte is subsequently discarded, but it could be
a byte from memory after the end of the report being parsed.
Fix this by rounding up and ending the loop one earlier.
 1.8.16.1  08-Apr-2020  martin Merge changes from current as of 20200406

RSS XML Feed