diff options
author | Solomon Peachy <pizza@shaftnet.org> | 2020-05-12 15:15:05 -0400 |
---|---|---|
committer | Solomon Peachy <pizza@shaftnet.org> | 2020-05-12 21:52:40 +0200 |
commit | f0ac5d123fba14aff1f8a7b65049ef16a982a534 (patch) | |
tree | 27a2cf33d576430e4fa7ff2d2eff881cbbd1abe8 | |
parent | b450707955677917fd2687d5d5d6700ce9d59930 (diff) | |
download | rockbox-f0ac5d123fba14aff1f8a7b65049ef16a982a534.tar.gz rockbox-f0ac5d123fba14aff1f8a7b65049ef16a982a534.zip |
m66591: Fix out-of-bounds array access
Loop terminator needed a preincrement rather than postincrement, and
also used a proper #define instead of a magic number.
Change-Id: Iafd6a0dce0304cb94e4f1d04cce46d2ca603507a
-rw-r--r-- | firmware/drivers/m66591.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/firmware/drivers/m66591.c b/firmware/drivers/m66591.c index 000e4582e1..d09b269f33 100644 --- a/firmware/drivers/m66591.c +++ b/firmware/drivers/m66591.c | |||
@@ -659,13 +659,13 @@ int usb_drv_request_endpoint(int type, int dir) { | |||
659 | } | 659 | } |
660 | } else if (type == USB_ENDPOINT_XFER_INT) { | 660 | } else if (type == USB_ENDPOINT_XFER_INT) { |
661 | ep=5; | 661 | ep=5; |
662 | 662 | ||
663 | pipecfg |= 1<<13; | 663 | pipecfg |= 1<<13; |
664 | 664 | ||
665 | while(M66591_eps[ep].busy && ep++<7); | 665 | while(M66591_eps[ep].busy && ++ep<USB_NUM_ENDPOINTS); |
666 | 666 | ||
667 | /* If this reached 7 the endpoints were all busy */ | 667 | /* If this reached USB_NUM_ENDPOINTS the endpoints were all busy */ |
668 | if(ep==7) { | 668 | if(ep==USB_NUM_ENDPOINTS) { |
669 | logf("mxx: ep %d busy", ep); | 669 | logf("mxx: ep %d busy", ep); |
670 | return -1; | 670 | return -1; |
671 | } | 671 | } |