in pms_proc_mouse, wsmouse_input is called with an uninitialized
'dz' variable if the sc->protocol->type is not PMS_STANDARD or
PMS_INTELLI.

Index: pms.c
===================================================================
RCS file: /cvs/src/sys/dev/pckbc/pms.c,v
retrieving revision 1.43
diff -u -p -r1.43 pms.c
--- pms.c       31 May 2013 19:21:09 -0000      1.43
+++ pms.c       28 Jun 2013 16:13:02 -0000
@@ -595,7 +595,7 @@ void
 pms_proc_mouse(struct pms_softc *sc)
 {
        u_int buttons;
-       int  dx, dy, dz;
+       int dx, dy, dz;
 
        buttons = butmap[sc->packet[0] & PMS_PS2_BUTTONSMASK];
        dx = (sc->packet[0] & PMS_PS2_XNEG) ?
@@ -604,11 +604,12 @@ pms_proc_mouse(struct pms_softc *sc)
            (int)sc->packet[2] - 256 : sc->packet[2];
 
        switch (sc->protocol->type) {
-       case PMS_STANDARD:
-               dz = 0;
-               break;
        case PMS_INTELLI:
                dz = (signed char)sc->packet[3];
+               break;
+       case PMS_STANDARD:
+       default:
+               dz = 0;
                break;
        }
 

Reply via email to