usb_hid: Fix copy length of key state array.

Twice the size was copied due to a missed adjustment in hrev31839,
reading past the key state array. This didn't cause any corruption
because the overwritten state wasn't used anymore later on and the
write didn't overrun. It could cause a crash however if the read went
past the allocated area.
This commit is contained in:
Michael Lotz 2015-04-23 22:19:17 +02:00
parent 0034a3c515
commit 87c27f4f27

View File

@ -771,6 +771,6 @@ KeyboardProtocolHandler::_ReadReport(bigtime_t timeout, uint32 *cookie)
keyDown = true;
}
memcpy(fLastKeys, fCurrentKeys, fKeyCount * sizeof(uint32));
memcpy(fLastKeys, fCurrentKeys, fKeyCount * sizeof(uint16));
return B_OK;
}