From: Mark Cave-Ayland Date: Sun, 24 Mar 2024 19:16:59 +0000 (+0000) Subject: esp.c: don't assert() if FIFO empty when executing non-DMA SELATNS X-Git-Tag: v9.0.0-rc3~8^2~7 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5a50644e4763b6e8370eddc10d30d87134a91167;p=thirdparty%2Fqemu.git esp.c: don't assert() if FIFO empty when executing non-DMA SELATNS The current logic assumes that at least 1 byte is present in the FIFO when executing a non-DMA SELATNS command, but this may not be the case if the guest executes an invalid ESP command sequence. Reported-by: Chuhong Yuan Signed-off-by: Mark Cave-Ayland Reviewed-by: Paolo Bonzini Reviewed-by: Philippe Mathieu-Daudé Message-Id: <20240324191707.623175-11-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland --- diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c index 1aac8f55645..f3aa5364cf4 100644 --- a/hw/scsi/esp.c +++ b/hw/scsi/esp.c @@ -762,7 +762,8 @@ static void esp_do_nodma(ESPState *s) case CMD_SELATNS: /* Copy one byte from FIFO into cmdfifo */ - len = esp_fifo_pop_buf(s, buf, 1); + len = esp_fifo_pop_buf(s, buf, + MIN(fifo8_num_used(&s->fifo), 1)); len = MIN(fifo8_num_free(&s->cmdfifo), len); fifo8_push_all(&s->cmdfifo, buf, len);