diff options
| author | Michael Brown | 2017-03-21 15:22:42 +0100 |
|---|---|---|
| committer | Michael Brown | 2017-03-21 15:22:42 +0100 |
| commit | 6124c0ebfae22542e5cbcc837143133fdb1d814d (patch) | |
| tree | 9b54b3a67045e181c84227d4d9b1704352a6e363 /src/drivers | |
| parent | [mucurses] Attempt to fix use of uninitialised buffer with strcat() (diff) | |
| download | ipxe-6124c0ebfae22542e5cbcc837143133fdb1d814d.tar.gz ipxe-6124c0ebfae22542e5cbcc837143133fdb1d814d.tar.xz ipxe-6124c0ebfae22542e5cbcc837143133fdb1d814d.zip | |
[xhci] Avoid accessing beyond end of endpoint context array
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/drivers')
| -rw-r--r-- | src/drivers/usb/xhci.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/drivers/usb/xhci.c b/src/drivers/usb/xhci.c index 48ac6a30..825171a5 100644 --- a/src/drivers/usb/xhci.c +++ b/src/drivers/usb/xhci.c @@ -1558,7 +1558,7 @@ static void xhci_transfer ( struct xhci_device *xhci, } /* Identify endpoint */ - if ( ( trb->endpoint > XHCI_CTX_END ) || + if ( ( trb->endpoint >= XHCI_CTX_END ) || ( ( endpoint = slot->endpoint[trb->endpoint] ) == NULL ) ) { DBGC ( xhci, "XHCI %s slot %d transfer event invalid epid " "%d:\n", xhci->name, slot->id, trb->endpoint ); |