diff options
| author | Peter Crosthwaite <peter.crosthwaite@xilinx.com> | 2014-08-04 14:41:54 +0100 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2014-08-04 14:41:54 +0100 |
| commit | 9db11cef8c557ccc6e0a3e7eca786b197eed5f59 (patch) | |
| tree | 0d0ac6b000eb5dc98338db0e990850b5914cc554 /hw/sd | |
| parent | fab46932393366792b438c078b48c196e9d35a1a (diff) | |
| download | qemu-9db11cef8c557ccc6e0a3e7eca786b197eed5f59.zip qemu-9db11cef8c557ccc6e0a3e7eca786b197eed5f59.tar.gz qemu-9db11cef8c557ccc6e0a3e7eca786b197eed5f59.tar.bz2 | |
sd: sdhci: Fix ADMA dma_memory_read access
This dma_memory_read was giving too big a size when begin was non-zero.
This could cause segfaults in some circumstances. Fix.
Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'hw/sd')
| -rw-r--r-- | hw/sd/sdhci.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c index b5a9eee..f9fe700 100644 --- a/hw/sd/sdhci.c +++ b/hw/sd/sdhci.c @@ -702,7 +702,8 @@ static void sdhci_do_adma(SDHCIState *s) length -= block_size - begin; } dma_memory_read(&address_space_memory, dscr.addr, - &s->fifo_buffer[begin], s->data_count); + &s->fifo_buffer[begin], + s->data_count - begin); dscr.addr += s->data_count - begin; if (s->data_count == block_size) { for (n = 0; n < block_size; n++) { |