From 00837731d254908a841d69298a4f9f077babaf24 Mon Sep 17 00:00:00 2001
From: Stefan Weil <sw@weilnetz.de>
Date: Fri, 20 Nov 2015 08:42:33 +0100
Subject: [PATCH] eepro100: Prevent two endless loops

http://lists.nongnu.org/archive/html/qemu-devel/2015-11/msg04592.html
shows an example how an endless loop in function action_command can
be achieved.

During my code review, I noticed a 2nd case which can result in an
endless loop.

Reported-by: Qinghao Tang <luodalongde@gmail.com>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 tools/qemu-xen-traditional/hw/eepro100.c |   16 ++++++++++++++++
 1 files changed, 16 insertions(+), 0 deletions(-)

diff --git a/tools/qemu-xen-traditional/hw/eepro100.c b/tools/qemu-xen-traditional/hw/eepro100.c
index 60333b7..685a478 100644
--- a/tools/qemu-xen-traditional/hw/eepro100.c
+++ b/tools/qemu-xen-traditional/hw/eepro100.c
@@ -774,6 +774,11 @@ static void tx_command(EEPRO100State *s)
                 uint32_t tx_buffer_address = ldl_phys(tbd_address);
                 uint16_t tx_buffer_size = lduw_phys(tbd_address + 4);
                 //~ uint16_t tx_buffer_el = lduw_phys(tbd_address + 6);
+                if (tx_buffer_size == 0) {
+                    /* Prevent an endless loop. */
+                    logout("loop in %s:%u\n", __FILE__, __LINE__);
+                    break;
+                }
                 tbd_address += 8;
                 logout
                     ("TBD (simplified mode): buffer address 0x%08x, size 0x%04x\n",
-- 
1.7.0.4