summaryrefslogtreecommitdiffstats
path: root/src/drivers/usb
diff options
context:
space:
mode:
authorMichael Brown2017-03-21 15:22:42 +0100
committerMichael Brown2017-03-21 15:22:42 +0100
commit6124c0ebfae22542e5cbcc837143133fdb1d814d (patch)
tree9b54b3a67045e181c84227d4d9b1704352a6e363 /src/drivers/usb
parent[mucurses] Attempt to fix use of uninitialised buffer with strcat() (diff)
downloadipxe-6124c0ebfae22542e5cbcc837143133fdb1d814d.tar.gz
ipxe-6124c0ebfae22542e5cbcc837143133fdb1d814d.tar.xz
ipxe-6124c0ebfae22542e5cbcc837143133fdb1d814d.zip
[xhci] Avoid accessing beyond end of endpoint context array
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/drivers/usb')
-rw-r--r--src/drivers/usb/xhci.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/drivers/usb/xhci.c b/src/drivers/usb/xhci.c
index 48ac6a30..825171a5 100644
--- a/src/drivers/usb/xhci.c
+++ b/src/drivers/usb/xhci.c
@@ -1558,7 +1558,7 @@ static void xhci_transfer ( struct xhci_device *xhci,
}
/* Identify endpoint */
- if ( ( trb->endpoint > XHCI_CTX_END ) ||
+ if ( ( trb->endpoint >= XHCI_CTX_END ) ||
( ( endpoint = slot->endpoint[trb->endpoint] ) == NULL ) ) {
DBGC ( xhci, "XHCI %s slot %d transfer event invalid epid "
"%d:\n", xhci->name, slot->id, trb->endpoint );