From 3ee42667a4bc832b8e246fc708c54d4a93196c91 Mon Sep 17 00:00:00 2001
From: Ian Dowse <iedowse@FreeBSD.org>
Date: Wed, 22 Mar 2006 02:04:12 +0000
Subject: [PATCH] Correct the calculation of the report size and only look at
 reports that have the specified kind, instead of assuming that there is only
 one report of the right kind in the report descriptor.

Submitted by:	Morten Johansen
Obtained from:	NetBSD (indirectly)
PR:		usb/77604
---
 sys/dev/usb/hid.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/sys/dev/usb/hid.c b/sys/dev/usb/hid.c
index ba78ec2d7c5..acd86bfba55 100644
--- a/sys/dev/usb/hid.c
+++ b/sys/dev/usb/hid.c
@@ -371,14 +371,22 @@ hid_report_size(void *buf, int len, enum hid_kind k, u_int8_t *idp)
 {
 	struct hid_data *d;
 	struct hid_item h;
-	int size, id;
+	int hi, lo, size, id;
 
 	id = 0;
+	hi = lo = -1;
 	for (d = hid_start_parse(buf, len, 1<<k); hid_get_item(d, &h); )
-		if (h.report_ID != 0 && !id)
-			id = h.report_ID;
+		if (h.kind == k) {
+			if (h.report_ID != 0 && !id)
+				id = h.report_ID;
+			if (h.report_ID == id) {
+				if (lo < 0)
+					lo = h.loc.pos;
+				hi = h.loc.pos + h.loc.size * h.loc.count;
+			}
+		}
 	hid_end_parse(d);
-	size = h.loc.pos;
+	size = hi - lo;
 	if (id != 0) {
 		size += 8;
 		*idp = id;	/* XXX wrong */