diff options
author | Solomon Peachy <pizza@shaftnet.org> | 2020-05-12 15:15:05 -0400 |
---|---|---|
committer | Solomon Peachy <pizza@shaftnet.org> | 2020-05-12 21:52:40 +0200 |
commit | f0ac5d123fba14aff1f8a7b65049ef16a982a534 (patch) | |
tree | 27a2cf33d576430e4fa7ff2d2eff881cbbd1abe8 | |
parent | b450707955677917fd2687d5d5d6700ce9d59930 (diff) | |
download | rockbox-f0ac5d123fba14aff1f8a7b65049ef16a982a534.tar.gz rockbox-f0ac5d123fba14aff1f8a7b65049ef16a982a534.zip |
m66591: Fix out-of-bounds array access
Loop terminator needed a preincrement rather than postincrement, and
also used a proper #define instead of a magic number.
Change-Id: Iafd6a0dce0304cb94e4f1d04cce46d2ca603507a
-rw-r--r-- | firmware/drivers/m66591.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/firmware/drivers/m66591.c b/firmware/drivers/m66591.c index 000e4582e1..d09b269f33 100644 --- a/firmware/drivers/m66591.c +++ b/firmware/drivers/m66591.c @@ -659,13 +659,13 @@ int usb_drv_request_endpoint(int type, int dir) { } } else if (type == USB_ENDPOINT_XFER_INT) { ep=5; - - pipecfg |= 1<<13; - - while(M66591_eps[ep].busy && ep++<7); - - /* If this reached 7 the endpoints were all busy */ - if(ep==7) { + + pipecfg |= 1<<13; + + while(M66591_eps[ep].busy && ++ep<USB_NUM_ENDPOINTS); + + /* If this reached USB_NUM_ENDPOINTS the endpoints were all busy */ + if(ep==USB_NUM_ENDPOINTS) { logf("mxx: ep %d busy", ep); return -1; } |