From mboxrd@z Thu Jan  1 00:00:00 1970
From: erik quanstrom <quanstro@quanstro.net>
Date: Fri, 28 Mar 2014 11:32:16 -0400
To: 9fans@9fans.net
Message-ID: <ab8e52c988f8503fa5f5c653f20ff09d@brasstown.quanstro.net>
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
Subject: [9fans] usb/kb parsing uninitialized memory
Topicbox-Message-UUID: d234c6b0-ead8-11e9-9d60-3106f5b1d025

i found this playing with one of those usb hid panels.

just tested with the busted apple 2005 keyboard and the newer
flat apple keyboard.  both worked.  (the 2005 keyboard doesn't
work on some h/w still due to the hub controller.)

i'm going to roll this into 9atom today.  unfortunately, since
there is a pending change to usb/kb, i'll have to delay on submitting
this to sources.

/n/dump/2014/0328/sys/src/cmd/usb/kb/kb.c:762,768 - kb.c:762,767
  	d->free = freekdev;
  	kd->in = in;
  	kd->dev = d;
- 	res = -1;
  	kd->ep = openep(d, ep->id);
  	if(kd->ep == nil){
  		fprint(2, "kb: %s: workep: openep %d: %r\n", d->dir, ep->id);
/n/dump/2014/0328/sys/src/cmd/usb/kb/kb.c:782,791 - kb.c:781,792
  				kd->idle = Dwcidle;
  		}
  	}
- 	if(!kd->bootp)
- 		res= setfirstconfig(kd, ep->id, desc, sizeof desc);
- 	if(res > 0)
- 		res = parsereportdesc(&kd->templ, desc, sizeof desc);
+ 	res = -1;
+ 	if(!kd->bootp){
+ 		n = setfirstconfig(kd, ep->id, desc, sizeof desc);
+ 		if(n > 0)
+ 			res = parsereportdesc(&kd->templ, desc, n);
+ 	}
  	/* if we could not set the first config, we give up */
  	if(kd->bootp || res < 0){
  		kd->bootp = 1;

- erik