[xhci] Avoid accessing beyond end of endpoint context array

Signed-off-by: Michael Brown <mcb30@ipxe.org>

diff --git a/src/drivers/usb/xhci.c b/src/drivers/usb/xhci.c
index 48ac6a30721de38202c43dc3e0631bc1d521b71e..825171a52509d5904d0e252ad5096891a5357b9c 100644 (file)
--- a/src/drivers/usb/xhci.c
+++ b/src/drivers/usb/xhci.c
@@ -1558,7 +1558,7 @@ static void xhci_transfer ( struct xhci_device *xhci,
        }
 
        /* Identify endpoint */
-       if ( ( trb->endpoint > XHCI_CTX_END ) ||
+       if ( ( trb->endpoint >= XHCI_CTX_END ) ||
             ( ( endpoint = slot->endpoint[trb->endpoint] ) == NULL ) ) {
                DBGC ( xhci, "XHCI %s slot %d transfer event invalid epid "
                       "%d:\n", xhci->name, slot->id, trb->endpoint );