Commit 9c49c83e authored by Eden Mikitas's avatar Eden Mikitas Committed by Peter Maydell
Browse files

hw/ssi/imx_spi: changed while statement to prevent underflow



The while statement in question only checked if tx_burst is not 0.
tx_burst is a signed int, which is assigned the value put by the
guest driver in ECSPI_CONREG. The burst length can be anywhere
between 1 and 4096, and since tx_burst is always decremented by 8
it could possibly underflow, causing an infinite loop.

Signed-off-by: default avatarEden Mikitas <e.mikitas@gmail.com>
Reviewed-by: default avatarAlistair Francis <alistair.francis@wdc.com>
Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parent 5d2f557b
Loading
Loading
Loading
Loading
+1 −1
Original line number Diff line number Diff line
@@ -182,7 +182,7 @@ static void imx_spi_flush_txfifo(IMXSPIState *s)

        rx = 0;

        while (tx_burst) {
        while (tx_burst > 0) {
            uint8_t byte = tx & 0xff;

            DPRINTF("writing 0x%02x\n", (uint32_t)byte);