Add checks to the endpoint and pipe configure functions and fail if the requested endpoint or pipe number is above the maximum for that device.

LUFA/Drivers/USB/Core/AVR8/Endpoint_AVR8.h

@@ -202,7 +202,12 @@
 			                                              const uint16_t Size,
 			                                              const uint8_t Banks)
 			{
-				return Endpoint_ConfigureEndpoint_Prv((Address & ENDPOINT_EPNUM_MASK),
+				uint8_t Number = (Address & ENDPOINT_EPNUM_MASK);
+			
+				if (Number >= ENDPOINT_TOTAL_ENDPOINTS)
+				  return false;
+			
+				return Endpoint_ConfigureEndpoint_Prv(Number,
 				                                      ((Type << EPTYPE0) | ((Address & ENDPOINT_DIR_IN) ? (1 << EPDIR) : 0)),
 				                                      ((1 << ALLOC) | ((Banks > 1) ? (1 << EPBK0) : 0) | Endpoint_BytesToEPSizeMask(Size)));
 			}

LUFA/Drivers/USB/Core/AVR8/Pipe_AVR8.c

@@ -66,6 +66,9 @@ bool Pipe_ConfigurePipe(const uint8_t Address,
 	uint8_t Number = (Address & PIPE_EPNUM_MASK);
 	uint8_t Token  = (Address & PIPE_DIR_IN) ? PIPE_TOKEN_IN : PIPE_TOKEN_OUT;
 	
+	if (Number >= PIPE_TOTAL_PIPES)
+	  return false;
+
 	if (Type == EP_TYPE_CONTROL)
 	  Token = PIPE_TOKEN_SETUP;
 

LUFA/Drivers/USB/Core/UC3/Endpoint_UC3.h

@@ -208,7 +208,12 @@
 			                                              const uint16_t Size,
 			                                              const uint8_t Banks)
 			{
-				return Endpoint_ConfigureEndpoint_Prv((Address & ENDPOINT_EPNUM_MASK),
+				uint8_t Number = (Address & ENDPOINT_EPNUM_MASK);
+			
+				if (Number >= ENDPOINT_TOTAL_ENDPOINTS)
+				  return false;
+
+				return Endpoint_ConfigureEndpoint_Prv(Number,
 				                                      (AVR32_USBB_ALLOC_MASK |
 				                                       ((uint32_t)Type << AVR32_USBB_EPTYPE_OFFSET) |
 				                                       ((Address & ENDPOINT_DIR_IN) ? AVR32_USBB_UECFG0_EPDIR_MASK : 0) |

LUFA/Drivers/USB/Core/UC3/Pipe_UC3.c

@@ -69,6 +69,9 @@ bool Pipe_ConfigurePipe(const uint8_t Address,
 	uint8_t Number = (Address & PIPE_EPNUM_MASK);
 	uint8_t Token  = (Address & PIPE_DIR_IN) ? PIPE_TOKEN_IN : PIPE_TOKEN_OUT;
 	
+	if (Number >= PIPE_TOTAL_PIPES)
+	  return false;
+
 	if (Type == EP_TYPE_CONTROL)
 	  Token = PIPE_TOKEN_SETUP;
 

LUFA/Drivers/USB/Core/XMEGA/Endpoint_XMEGA.h

@@ -246,8 +246,12 @@
 			{
 				uint8_t EPConfigMask = (USB_EP_INTDSBL_bm | ((Banks > 1) ? USB_EP_PINGPONG_bm : 0) | Endpoint_BytesToEPSizeMask(Size));
 
+				if ((Address & ENDPOINT_EPNUM_MASK) >= ENDPOINT_TOTAL_ENDPOINTS)
+				  return false;
+
 				// TODO - Fix once limitations are lifted
-				if ((Banks > 1) || (Size > 64))
+				EPConfigMask &= ~USB_EP_PINGPONG_bm;
+				if (Size > 64)
 				  return false;
 
 				switch (Type)

LUFA/Drivers/USB/Core/XMEGA/USBController_XMEGA.c

@@ -76,7 +76,7 @@ void USB_Init(
 	USB.CAL1 = pgm_read_byte(offsetof(NVM_PROD_SIGNATURES_t, USBCAL1));
 	NVM.CMD  = 0;
 
-	/* Ugly workaround to ensure an aligned table, since __BIGGEST_ALIGNMENT__ == 1 for 8-bit AVR-GCC */
+	/* Ugly workaround to ensure an aligned table, since __BIGGEST_ALIGNMENT__ == 1 for the 8-bit AVR-GCC toochain */
 	USB.EPPTR = ((intptr_t)&USB_EndpointTable[1] & ~(1 << 0));
 	USB.CTRLA = (USB_STFRNUM_bm | ((ENDPOINT_TOTAL_ENDPOINTS - 1) << USB_MAXEP_gp));