From 6124c0ebfae22542e5cbcc837143133fdb1d814d Mon Sep 17 00:00:00 2001
From: Michael Brown <mcb30@ipxe.org>
Date: Tue, 21 Mar 2017 16:22:42 +0200
Subject: [PATCH] [xhci] Avoid accessing beyond end of endpoint context array

Signed-off-by: Michael Brown <mcb30@ipxe.org>
---
 src/drivers/usb/xhci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/drivers/usb/xhci.c b/src/drivers/usb/xhci.c
index 48ac6a30..825171a5 100644
--- a/src/drivers/usb/xhci.c
+++ b/src/drivers/usb/xhci.c
@@ -1558,7 +1558,7 @@ static void xhci_transfer ( struct xhci_device *xhci,
 	}
 
 	/* Identify endpoint */
-	if ( ( trb->endpoint > XHCI_CTX_END ) ||
+	if ( ( trb->endpoint >= XHCI_CTX_END ) ||
 	     ( ( endpoint = slot->endpoint[trb->endpoint] ) == NULL ) ) {
 		DBGC ( xhci, "XHCI %s slot %d transfer event invalid epid "
 		       "%d:\n", xhci->name, slot->id, trb->endpoint );