On Sun, Jun 29, 2025 at 05:49:45PM -0400, Seungjin Bae wrote:
In the max3420_set_clear_feature() function, the endpoint index `id` can have a value from 0 to 15. However, the udc->ep array is initialized with a maximum of 4 endpoints in max3420_eps_init(). If host sends a request with a wIndex greater than 3, the access to `udc->ep[id]` will go out-of-bounds, leading to memory corruption or a potential kernel crash. This bug was found by code inspection and has not been tested on hardware.
Please wrap your lines at 72 columns.
Also, you sent 2 patches, with identical subject lines, but they did different things. That's not ok as you know.
And I think you really need to test this on hardware. How could that request ever have a windex set to greater than 3? Is that a hardware value or a user-controlled value?
thanks,
greg k-h