diff options
| author | Peng Fan <peng.fan@nxp.com> | 2016-01-12 13:50:51 +0800 |
|---|---|---|
| committer | guoyin.chen <guoyin.chen@freescale.com> | 2016-03-04 15:53:39 +0800 |
| commit | 722af7af28acea2fff86262ad58343edec9c37ca (patch) | |
| tree | 0941d2a8d48c234c4347ca86f71f5789e33ee838 | |
| parent | 420788d38f9d9ff1db38cccc42d415211bd8ddfb (diff) | |
| download | u-boot-imx-722af7af28acea2fff86262ad58343edec9c37ca.zip u-boot-imx-722af7af28acea2fff86262ad58343edec9c37ca.tar.gz u-boot-imx-722af7af28acea2fff86262ad58343edec9c37ca.tar.bz2 | |
MLK-12206 common: usb: fix check condition
We support max 16 endpoints, but endpoint starts from 0.
So we need to use >= 16 but not > 16 to check whether we
already reach max endpoints or not.
Coverity ID 17955:
Out-of-bounds read (OVERRUN)
37. overrun-local: Overrunning array dev->config.if_desc[ifno].ep_desc of 16
9-byte elements at element index 16 (byte offset 144) using index epno
(which evaluates to 16).
Signed-off-by: Peng Fan <peng.fan@nxp.com>
| -rw-r--r-- | common/usb.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/common/usb.c b/common/usb.c index 32e15cd..7c02fbd 100644 --- a/common/usb.c +++ b/common/usb.c @@ -418,7 +418,7 @@ static int usb_parse_config(struct usb_device *dev, } epno = dev->config.if_desc[ifno].no_of_ep; if_desc = &dev->config.if_desc[ifno]; - if (epno > USB_MAXENDPOINTS) { + if (epno >= USB_MAXENDPOINTS) { printf("Interface %d has too many endpoints!\n", if_desc->desc.bInterfaceNumber); return 1; |