From: Michael Brown <mcb30@ipxe.org>
Date: Tue, 21 Mar 2017 14:22:42 +0000 (+0200)
Subject: [xhci] Avoid accessing beyond end of endpoint context array
X-Git-Tag: v1.20.1~269
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6124c0ebfae22542e5cbcc837143133fdb1d814d;p=thirdparty%2Fipxe.git

[xhci] Avoid accessing beyond end of endpoint context array

Signed-off-by: Michael Brown <mcb30@ipxe.org>
---

diff --git a/src/drivers/usb/xhci.c b/src/drivers/usb/xhci.c
index 48ac6a307..825171a52 100644
--- a/src/drivers/usb/xhci.c
+++ b/src/drivers/usb/xhci.c
@@ -1558,7 +1558,7 @@ static void xhci_transfer ( struct xhci_device *xhci,
 	}
 
 	/* Identify endpoint */
-	if ( ( trb->endpoint > XHCI_CTX_END ) ||
+	if ( ( trb->endpoint >= XHCI_CTX_END ) ||
 	     ( ( endpoint = slot->endpoint[trb->endpoint] ) == NULL ) ) {
 		DBGC ( xhci, "XHCI %s slot %d transfer event invalid epid "
 		       "%d:\n", xhci->name, slot->id, trb->endpoint );