From owner-svn-src-head@FreeBSD.ORG  Sun May  9 09:20:26 2010
Return-Path: <owner-svn-src-head@FreeBSD.ORG>
Delivered-To: svn-src-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 1ED6F106564A;
	Sun,  9 May 2010 09:20:26 +0000 (UTC)
	(envelope-from kaiw@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org [69.147.83.44])
	by mx1.freebsd.org (Postfix) with ESMTP id 0E4D78FC15;
	Sun,  9 May 2010 09:20:26 +0000 (UTC)
Received: from svn.freebsd.org (localhost [127.0.0.1])
	by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id o499KPph089988;
	Sun, 9 May 2010 09:20:25 GMT (envelope-from kaiw@svn.freebsd.org)
Received: (from kaiw@localhost)
	by svn.freebsd.org (8.14.3/8.14.3/Submit) id o499KPGD089986;
	Sun, 9 May 2010 09:20:25 GMT (envelope-from kaiw@svn.freebsd.org)
Message-Id: <201005090920.o499KPGD089986@svn.freebsd.org>
From: Kai Wang <kaiw@FreeBSD.org>
Date: Sun, 9 May 2010 09:20:25 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
	svn-src-head@freebsd.org
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Cc: 
Subject: svn commit: r207812 - head/usr.sbin/bluetooth/bthidd
X-BeenThere: svn-src-head@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: SVN commit messages for the src tree for head/-current
	<svn-src-head.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-head>,
	<mailto:svn-src-head-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-head>
List-Post: <mailto:svn-src-head@freebsd.org>
List-Help: <mailto:svn-src-head-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-head>,
	<mailto:svn-src-head-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 09 May 2010 09:20:26 -0000

Author: kaiw
Date: Sun May  9 09:20:25 2010
New Revision: 207812
URL: http://svn.freebsd.org/changeset/base/207812

Log:
  Catch up with libusbhid merge (rev 205728).
  
  hid_get_data() now expects that the hid data passed in always contains
  the report ID byte. Thus we should not skip the the report ID byte in
  hid_interrupt().  Also, if HUP_KEYBOARD usage is an array, do not try
  to modify the 'data' pointer, instead, increase the hid_item_t field
  'pos' by 'report_size' before calling hid_get_data() during each
  iteration.
  
  PR:			usb/146367
  Reported and tested by:	Alex Deiter
  Pointy hat to:	    	kaiw
  Reviewed by:	    	emax

Modified:
  head/usr.sbin/bluetooth/bthidd/hid.c

Modified: head/usr.sbin/bluetooth/bthidd/hid.c
==============================================================================
--- head/usr.sbin/bluetooth/bthidd/hid.c	Sun May  9 08:22:33 2010	(r207811)
+++ head/usr.sbin/bluetooth/bthidd/hid.c	Sun May  9 09:20:25 2010	(r207812)
@@ -130,7 +130,7 @@ hid_interrupt(bthid_session_p s, uint8_t
 	hid_item_t	h;
 	int32_t		report_id, usage, page, val,
 			mouse_x, mouse_y, mouse_z, mouse_butt,
-			mevents, kevents;
+			mevents, kevents, i;
 
 	assert(s != NULL);
 	assert(s->srv != NULL);
@@ -150,8 +150,8 @@ hid_interrupt(bthid_session_p s, uint8_t
 	}
 
 	report_id = data[1];
-	data += 2;
-	len -= 2;
+	data ++;
+	len --;
 
 	hid_device = get_hid_device(&s->bdaddr);
 	assert(hid_device != NULL);
@@ -202,17 +202,11 @@ hid_interrupt(bthid_session_p s, uint8_t
 				if (val && val < kbd_maxkey())
 					bit_set(s->keys1, val);
 
-				data ++;
-				len --;
-
-				len = min(len, h.report_size);
-				while (len > 0) {
+				for (i = 1; i < h.report_count; i++) {
+					h.pos += h.report_size;
 					val = hid_get_data(data, &h);
 					if (val && val < kbd_maxkey())
 						bit_set(s->keys1, val);
-
-					data ++;
-					len --;
 				}
 			}
 			break;