| commit | 9c49c83e4b23d31676633a1189faa6e70b489c01 | |
| author | Eden Mikitas <e.mikitas@gmail.com> | |
| Tue, 2 Jun 2020 12:44:34 +0000 (2 13:44 +0100) | ||
| committer | Peter Maydell <peter.maydell@linaro.org> | |
| Fri, 5 Jun 2020 16:23:08 +0000 (5 17:23 +0100) | ||
| tree | a17da6b23e17d28065fa1b90a242ad7c393686e6 | treesnapshot (tar.gz zip) |
| parent | 5d2f557b47dfbf8f23277a5bdd8473d4607c681a | commitdiff |
hw/ssi/imx_spi: changed while statement to prevent underflow
The while statement in question only checked if tx_burst is not 0.
tx_burst is a signed int, which is assigned the value put by the
guest driver in ECSPI_CONREG. The burst length can be anywhere
between 1 and 4096, and since tx_burst is always decremented by 8
it could possibly underflow, causing an infinite loop.
Signed-off-by: Eden Mikitas <e.mikitas@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
The while statement in question only checked if tx_burst is not 0.
tx_burst is a signed int, which is assigned the value put by the
guest driver in ECSPI_CONREG. The burst length can be anywhere
between 1 and 4096, and since tx_burst is always decremented by 8
it could possibly underflow, causing an infinite loop.
Signed-off-by: Eden Mikitas <e.mikitas@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| hw/ssi/imx_spi.c | diffblobblamehistory |