From f0ac5d123fba14aff1f8a7b65049ef16a982a534 Mon Sep 17 00:00:00 2001
From: Solomon Peachy <pizza@shaftnet.org>
Date: Tue, 12 May 2020 15:15:05 -0400
Subject: m66591:  Fix out-of-bounds array access

Loop terminator needed a preincrement rather than postincrement, and
also used a proper #define instead of a magic number.

Change-Id: Iafd6a0dce0304cb94e4f1d04cce46d2ca603507a
---
 firmware/drivers/m66591.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

(limited to 'firmware/drivers')

diff --git a/firmware/drivers/m66591.c b/firmware/drivers/m66591.c
index 000e4582e1..d09b269f33 100644
--- a/firmware/drivers/m66591.c
+++ b/firmware/drivers/m66591.c
@@ -659,13 +659,13 @@ int usb_drv_request_endpoint(int type, int dir) {
         }
     } else if (type == USB_ENDPOINT_XFER_INT) {
         ep=5;
-        
-        pipecfg |= 1<<13; 
-        
-        while(M66591_eps[ep].busy && ep++<7);
-        
-        /* If this reached 7 the endpoints were all busy */
-        if(ep==7) {
+
+        pipecfg |= 1<<13;
+
+        while(M66591_eps[ep].busy && ++ep<USB_NUM_ENDPOINTS);
+
+        /* If this reached USB_NUM_ENDPOINTS the endpoints were all busy */
+        if(ep==USB_NUM_ENDPOINTS) {
             logf("mxx: ep %d busy", ep);
             return -1;
         }
-- 
cgit