From: Prasad J Pandit <[email protected]> Intel HDA emulator uses stream of buffers during DMA data transfers. Each entry has buffer length and buffer pointer position, which are used to derive bytes to 'copy'. If this length and buffer pointer were to be same, 'copy' could be set to zero(0), leading to an infinite loop. Add check to avoid it.
Reported-by: Huawei PSIRT <[email protected]> Signed-off-by: Prasad J Pandit <[email protected]> --- hw/audio/intel-hda.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c index cd95340..537face 100644 --- a/hw/audio/intel-hda.c +++ b/hw/audio/intel-hda.c @@ -416,7 +416,8 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output, } left = len; - while (left > 0) { + s = st->bentries; + while (left > 0 && s-- > 0) { copy = left; if (copy > st->bsize - st->lpib) copy = st->bsize - st->lpib; -- 2.7.4
