From 9c49c83e4b23d31676633a1189faa6e70b489c01 Mon Sep 17 00:00:00 2001 From: Eden Mikitas Date: Tue, 2 Jun 2020 13:44:34 +0100 Subject: hw/ssi/imx_spi: changed while statement to prevent underflow The while statement in question only checked if tx_burst is not 0. tx_burst is a signed int, which is assigned the value put by the guest driver in ECSPI_CONREG. The burst length can be anywhere between 1 and 4096, and since tx_burst is always decremented by 8 it could possibly underflow, causing an infinite loop. Signed-off-by: Eden Mikitas Reviewed-by: Alistair Francis Signed-off-by: Peter Maydell --- hw/ssi/imx_spi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'hw') diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c index 2dd9a63..6fef5c7 100644 --- a/hw/ssi/imx_spi.c +++ b/hw/ssi/imx_spi.c @@ -182,7 +182,7 @@ static void imx_spi_flush_txfifo(IMXSPIState *s) rx = 0; - while (tx_burst) { + while (tx_burst > 0) { uint8_t byte = tx & 0xff; DPRINTF("writing 0x%02x\n", (uint32_t)byte); -- cgit v1.1