From a56d305a6d706cd75cfe0fa473f45772694f2a4a Mon Sep 17 00:00:00 2001 From: Peter Crosthwaite Date: Fri, 25 Jan 2013 17:58:38 -0800 Subject: m25p80.c: Return state to IDLE after COLLECTING Default to moving back to the IDLE state after the COLLECTING_DATA state. For a well behaved guest this patch has no consequence, but A bad guest could crash QEMU by using one of the erase commands followed by a longer than 5 byte argument (undefined behaviour). Signed-off-by: Peter Crosthwaite Signed-off-by: Edgar E. Iglesias --- hw/m25p80.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'hw/m25p80.c') diff --git a/hw/m25p80.c b/hw/m25p80.c index d39265632b..788c19608c 100644 --- a/hw/m25p80.c +++ b/hw/m25p80.c @@ -358,6 +358,8 @@ static void complete_collecting_data(Flash *s) s->cur_addr |= s->data[1] << 8; s->cur_addr |= s->data[2]; + s->state = STATE_IDLE; + switch (s->cmd_in_progress) { case DPP: case QPP: -- cgit v1.2.3