github/acrn-hypervisor
1
0
Fork 0
mirror of https://github.com/projectacrn/acrn-hypervisor.git synced 2025-07-30 23:16:40 +00:00
Code Issues Projects Releases Wiki Activity

dm: array bound checking to avoid buffer overflow

Browse Source 
The array index of "epid" may be out of bounds if
"epid >= XHCI_MAX_ENDPOINTS", so bound check is
necessary before it is used.

Tracked-On: #3434
Signed-off-by: Tianhua Sun <tianhuax.s.sun@intel.com>
Reviewed-by: Yonghua Huang <yonghua.huang@intel.com>
Reviewed-by: Xiaoguang Wu <xiaoguang.wu@intel.com>
This commit is contained in:
Tianhua Sun 2019-07-17 16:39:48 +08:00 committed by ACRN System Integration
parent 493ddefd47
commit 107c406baa
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
devicemodel/hw/pci/xhci.c
View File

@ -3718,6 +3718,8 @@ pci_xhci_dev_intr(struct usb_hci *hci, int epctx)
/* HW endpoint contexts are 0-15; convert to epid based on dir */
epid = (epid * 2) + (dir_in ? 1 : 0);
if (epid >= XHCI_MAX_ENDPOINTS)
return 0;
dev = hci->dev;
xdev = dev->xdev;