4747/* INPUT */
4848/* */
4949/* descriptor Pointer to descriptor */
50+ /* length Length of descriptor */
5051/* item Pointer to item */
5152/* */
5253/* OUTPUT */
6263/* HID Class */
6364/* */
6465/**************************************************************************/
65- UINT _ux_host_class_hid_report_item_analyse (UCHAR * descriptor , UX_HOST_CLASS_HID_ITEM * item )
66+ UINT _ux_host_class_hid_report_item_analyse (UCHAR * descriptor , ULONG length , UX_HOST_CLASS_HID_ITEM * item )
6667{
6768
6869UCHAR item_byte ;
6970UINT result = UX_SUCCESS ;
7071
72+ /* Make sure descriptor has minimal length.*/
73+ if (length == 0 )
74+ {
75+ return (UX_DESCRIPTOR_CORRUPTED );
76+ }
77+
7178 /* Get the first byte from the descriptor. */
7279 item_byte = * descriptor ;
7380
@@ -83,7 +90,7 @@ UINT result = UX_SUCCESS;
8390 item -> ux_host_class_hid_item_report_type = (item_byte >> 2 ) & 3 ;
8491
8592 /* Make sure descriptor has minimal length.*/
86- if (sizeof ( descriptor ) >= 3 )
93+ if (length >= 3 )
8794 {
8895 /* Get its length (byte 1). */
8996 item -> ux_host_class_hid_item_report_length = (USHORT ) * (descriptor + 1 );
@@ -120,11 +127,14 @@ UINT result = UX_SUCCESS;
120127 /* Set the type. */
121128 item -> ux_host_class_hid_item_report_type = (item_byte >> 2 ) & 3 ;
122129
123- /* Set the tag. */
124- item -> ux_host_class_hid_item_report_tag = item_byte >> 4 ;
130+ /* Then the tag. */
131+ item -> ux_host_class_hid_item_report_tag = (item_byte >> 4 ) & 0xf ;
132+
133+ /* Mark its format. For short items, this is always 1. */
134+ item -> ux_host_class_hid_item_report_format = 1 ;
135+
125136 }
126137
127- /* Return successful completion . */
138+ /* Return result . */
128139 return (result );
129140}
130-
0 commit comments