[xhci] Avoid accessing beyond end of endpoint context array

Signed-off-by: Michael Brown <mcb30@ipxe.org>
ipxe · Mar 21, 2017 · 6124c0e · 6124c0e
1 parent 501fa53
commit 6124c0e
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/drivers/usb/xhci.c b/src/drivers/usb/xhci.c
@@ -1558,7 +1558,7 @@ static void xhci_transfer ( struct xhci_device *xhci,
 	}
 
 	/* Identify endpoint */
-	if ( ( trb->endpoint > XHCI_CTX_END ) ||
+	if ( ( trb->endpoint >= XHCI_CTX_END ) ||
 	     ( ( endpoint = slot->endpoint[trb->endpoint] ) == NULL ) ) {
 		DBGC ( xhci, "XHCI %s slot %d transfer event invalid epid "
 		       "%d:\n", xhci->name, slot->id, trb->endpoint );