@@ -45,6 +45,34 @@ static int hid_ignore_special_drivers = 0;
4545module_param_named (ignore_special_drivers , hid_ignore_special_drivers , int , 0600 );
4646MODULE_PARM_DESC (ignore_special_drivers , "Ignore any special drivers and handle all devices by generic driver" );
4747
48+ /*
49+ * Convert a signed n-bit integer to signed 32-bit integer.
50+ */
51+
52+ static s32 snto32 (__u32 value , unsigned int n )
53+ {
54+ if (!value || !n )
55+ return 0 ;
56+
57+ if (n > 32 )
58+ n = 32 ;
59+
60+ return sign_extend32 (value , n - 1 );
61+ }
62+
63+ /*
64+ * Convert a signed 32-bit integer to a signed n-bit integer.
65+ */
66+
67+ static u32 s32ton (__s32 value , unsigned int n )
68+ {
69+ s32 a = value >> (n - 1 );
70+
71+ if (a && a != -1 )
72+ return value < 0 ? 1 << (n - 1 ) : (1 << (n - 1 )) - 1 ;
73+ return value & ((1 << n ) - 1 );
74+ }
75+
4876/*
4977 * Register a new report for a device.
5078 */
@@ -425,7 +453,7 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
425453 * both this and the standard encoding. */
426454 raw_value = item_sdata (item );
427455 if (!(raw_value & 0xfffffff0 ))
428- parser -> global .unit_exponent = hid_snto32 (raw_value , 4 );
456+ parser -> global .unit_exponent = snto32 (raw_value , 4 );
429457 else
430458 parser -> global .unit_exponent = raw_value ;
431459 return 0 ;
@@ -754,35 +782,29 @@ static const u8 *fetch_item(const __u8 *start, const __u8 *end, struct hid_item
754782 }
755783
756784 item -> format = HID_ITEM_FORMAT_SHORT ;
757- item -> size = b & 3 ;
785+ item -> size = BIT (b & 3 ) >> 1 ; /* 0, 1, 2, 3 -> 0, 1, 2, 4 */
786+
787+ if (end - start < item -> size )
788+ return NULL ;
758789
759790 switch (item -> size ) {
760791 case 0 :
761- return start ;
792+ break ;
762793
763794 case 1 :
764- if ((end - start ) < 1 )
765- return NULL ;
766- item -> data .u8 = * start ++ ;
767- return start ;
795+ item -> data .u8 = * start ;
796+ break ;
768797
769798 case 2 :
770- if ((end - start ) < 2 )
771- return NULL ;
772799 item -> data .u16 = get_unaligned_le16 (start );
773- start = (__u8 * )((__le16 * )start + 1 );
774- return start ;
800+ break ;
775801
776- case 3 :
777- item -> size ++ ;
778- if ((end - start ) < 4 )
779- return NULL ;
802+ case 4 :
780803 item -> data .u32 = get_unaligned_le32 (start );
781- start = (__u8 * )((__le32 * )start + 1 );
782- return start ;
804+ break ;
783805 }
784806
785- return NULL ;
807+ return start + item -> size ;
786808}
787809
788810static void hid_scan_input_usage (struct hid_parser * parser , u32 usage )
@@ -1315,46 +1337,6 @@ int hid_open_report(struct hid_device *device)
13151337}
13161338EXPORT_SYMBOL_GPL (hid_open_report );
13171339
1318- /*
1319- * Convert a signed n-bit integer to signed 32-bit integer. Common
1320- * cases are done through the compiler, the screwed things has to be
1321- * done by hand.
1322- */
1323-
1324- static s32 snto32 (__u32 value , unsigned n )
1325- {
1326- if (!value || !n )
1327- return 0 ;
1328-
1329- if (n > 32 )
1330- n = 32 ;
1331-
1332- switch (n ) {
1333- case 8 : return ((__s8 )value );
1334- case 16 : return ((__s16 )value );
1335- case 32 : return ((__s32 )value );
1336- }
1337- return value & (1 << (n - 1 )) ? value | (~0U << n ) : value ;
1338- }
1339-
1340- s32 hid_snto32 (__u32 value , unsigned n )
1341- {
1342- return snto32 (value , n );
1343- }
1344- EXPORT_SYMBOL_GPL (hid_snto32 );
1345-
1346- /*
1347- * Convert a signed 32-bit integer to a signed n-bit integer.
1348- */
1349-
1350- static u32 s32ton (__s32 value , unsigned n )
1351- {
1352- s32 a = value >> (n - 1 );
1353- if (a && a != -1 )
1354- return value < 0 ? 1 << (n - 1 ) : (1 << (n - 1 )) - 1 ;
1355- return value & ((1 << n ) - 1 );
1356- }
1357-
13581340/*
13591341 * Extract/implement a data field from/to a little endian report (bit array).
13601342 *
0 commit comments