mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

m25p80.c: Return state to IDLE after COLLECTING

Browse Source 
Default to moving back to the IDLE state after the COLLECTING_DATA
state. For a well behaved guest this patch has no consequence, but
A bad guest could crash QEMU by using one of the erase commands
followed by a longer than 5 byte argument (undefined behaviour).

Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
This commit is contained in:
Peter Crosthwaite 2013-01-25 17:58:38 -08:00 committed by Edgar E. Iglesias
parent 2f991adb8e
commit a56d305a6d
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
hw/m25p80.c
View File

@ -358,6 +358,8 @@ static void complete_collecting_data(Flash *s)
s->cur_addr |= s->data[1] << 8; s->cur_addr |= s->data[1] << 8;
s->cur_addr |= s->data[2]; s->cur_addr |= s->data[2];
s->state = STATE_IDLE;
switch (s->cmd_in_progress) { switch (s->cmd_in_progress) {
case DPP: case DPP:
case QPP: case QPP: