diff options
| author | ebadger <[email protected]> | 2020-08-24 13:38:06 -0700 |
|---|---|---|
| committer | GitHub <[email protected]> | 2020-08-24 13:38:06 -0700 |
| commit | aaeca58c5e7b67740a603a3150db225670b42bb6 (patch) | |
| tree | 8df3ce3f2b18ec18b85d740878acc60685c40fb3 /hid/hclient/report.c | |
| parent | dbadff83eed662c244d5a6fae48baa840fb543b8 (diff) | |
fix bug in PackReport (#534)186186
Data is pointer to array of HID_DATA structure.
Function advances pointer as it packs the report buffer.
At end of process the function attempts to go back through the buffer and update the IsDataSet member.
What it's actually doing is writing unexpected memory locations.
Fix is to store the head of the array and move back before walking again to set the bits.
Diffstat (limited to 'hid/hclient/report.c')
| -rw-r--r-- | hid/hclient/report.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/hid/hclient/report.c b/hid/hclient/report.c index f1d9ee55..02fb95a9 100644 --- a/hid/hclient/report.c +++ b/hid/hclient/report.c @@ -513,7 +513,7 @@ Routine Description: ULONG i; ULONG CurrReportID; BOOLEAN result = FALSE; - + PHID_DATA Head = Data; /* // All report buffers that are initially sent need to be zero'd out */ @@ -584,6 +584,7 @@ Routine Description: // having been set. */ + Data = Head; for (i = 0; i < DataLength; i++, Data++) { if (CurrReportID == Data -> ReportID) |