summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSolomon Peachy <pizza@shaftnet.org>2020-05-12 15:15:05 -0400
committerSolomon Peachy <pizza@shaftnet.org>2020-05-12 21:52:40 +0200
commitf0ac5d123fba14aff1f8a7b65049ef16a982a534 (patch)
tree27a2cf33d576430e4fa7ff2d2eff881cbbd1abe8
parentb450707955677917fd2687d5d5d6700ce9d59930 (diff)
downloadrockbox-f0ac5d123fba14aff1f8a7b65049ef16a982a534.tar.gz
rockbox-f0ac5d123fba14aff1f8a7b65049ef16a982a534.zip
m66591: Fix out-of-bounds array access
Loop terminator needed a preincrement rather than postincrement, and also used a proper #define instead of a magic number. Change-Id: Iafd6a0dce0304cb94e4f1d04cce46d2ca603507a
-rw-r--r--firmware/drivers/m66591.c14
1 files changed, 7 insertions, 7 deletions
diff --git a/firmware/drivers/m66591.c b/firmware/drivers/m66591.c
index 000e4582e1..d09b269f33 100644
--- a/firmware/drivers/m66591.c
+++ b/firmware/drivers/m66591.c
@@ -659,13 +659,13 @@ int usb_drv_request_endpoint(int type, int dir) {
}
} else if (type == USB_ENDPOINT_XFER_INT) {
ep=5;
-
- pipecfg |= 1<<13;
-
- while(M66591_eps[ep].busy && ep++<7);
-
- /* If this reached 7 the endpoints were all busy */
- if(ep==7) {
+
+ pipecfg |= 1<<13;
+
+ while(M66591_eps[ep].busy && ++ep<USB_NUM_ENDPOINTS);
+
+ /* If this reached USB_NUM_ENDPOINTS the endpoints were all busy */
+ if(ep==USB_NUM_ENDPOINTS) {
logf("mxx: ep %d busy", ep);
return -1;
}