Skip to content

Commit 107c406

Browse files
tianhuasacrnsi
authored andcommitted
dm: array bound checking to avoid buffer overflow
The array index of "epid" may be out of bounds if "epid >= XHCI_MAX_ENDPOINTS", so bound check is necessary before it is used. Tracked-On: #3434 Signed-off-by: Tianhua Sun <tianhuax.s.sun@intel.com> Reviewed-by: Yonghua Huang <yonghua.huang@intel.com> Reviewed-by: Xiaoguang Wu <xiaoguang.wu@intel.com>
1 parent 493ddef commit 107c406

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

devicemodel/hw/pci/xhci.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3718,6 +3718,8 @@ pci_xhci_dev_intr(struct usb_hci *hci, int epctx)
37183718

37193719
/* HW endpoint contexts are 0-15; convert to epid based on dir */
37203720
epid = (epid * 2) + (dir_in ? 1 : 0);
3721+
if (epid >= XHCI_MAX_ENDPOINTS)
3722+
return 0;
37213723

37223724
dev = hci->dev;
37233725
xdev = dev->xdev;

0 commit comments

Comments
 (0)