diff options
| author | Michael Brown <mcb30@ipxe.org> | 2017-03-21 16:22:42 +0200 |
|---|---|---|
| committer | Michael Brown <mcb30@ipxe.org> | 2017-03-21 16:22:42 +0200 |
| commit | 6124c0ebfae22542e5cbcc837143133fdb1d814d (patch) | |
| tree | 9b54b3a67045e181c84227d4d9b1704352a6e363 /src/drivers/usb/xhci.c | |
| parent | 501fa53b2587642f1459fa79db71359e8eac75dc (diff) | |
| download | ipxe-6124c0ebfae22542e5cbcc837143133fdb1d814d.tar.gz | |
[xhci] Avoid accessing beyond end of endpoint context array
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/drivers/usb/xhci.c')
| -rw-r--r-- | src/drivers/usb/xhci.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/drivers/usb/xhci.c b/src/drivers/usb/xhci.c index 48ac6a307..825171a52 100644 --- a/src/drivers/usb/xhci.c +++ b/src/drivers/usb/xhci.c @@ -1558,7 +1558,7 @@ static void xhci_transfer ( struct xhci_device *xhci, } /* Identify endpoint */ - if ( ( trb->endpoint > XHCI_CTX_END ) || + if ( ( trb->endpoint >= XHCI_CTX_END ) || ( ( endpoint = slot->endpoint[trb->endpoint] ) == NULL ) ) { DBGC ( xhci, "XHCI %s slot %d transfer event invalid epid " "%d:\n", xhci->name, slot->id, trb->endpoint ); |