Message ID | 20210407195801.685-10-mark.cave-ayland@ilande.co.uk |
---|---|
State | New |
Headers | show |
Series | esp: fix asserts/segfaults discovered by fuzzer | expand |
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c index 53cc569e8a..782c6ee357 100644 --- a/hw/scsi/esp.c +++ b/hw/scsi/esp.c @@ -578,6 +578,7 @@ static void esp_do_dma(ESPState *s) cmdlen = fifo8_num_used(&s->cmdfifo); trace_esp_do_dma(cmdlen, len); if (s->dma_memory_read) { + len = MIN(len, fifo8_num_free(&s->cmdfifo)); s->dma_memory_read(s->dma_opaque, buf, len); fifo8_push_all(&s->cmdfifo, buf, len); } else {