diff options
author | rich cannings <richc@google.com> | 2011-01-25 15:06:02 -0800 |
---|---|---|
committer | Android Code Review <code-review@android.com> | 2011-01-25 15:06:02 -0800 |
commit | eaabfc3446b266a07eb8ac175527c52ad2382196 (patch) | |
tree | f424f4348ab43f0de65c8752beeffe42556ee58c | |
parent | 2223b9aef3c87386f51d007fa3e03a6f2ac41e74 (diff) | |
parent | 2091a098485fb6d386827aef3fb4732ae1cfac83 (diff) | |
download | external_qemu-eaabfc3446b266a07eb8ac175527c52ad2382196.zip external_qemu-eaabfc3446b266a07eb8ac175527c52ad2382196.tar.gz external_qemu-eaabfc3446b266a07eb8ac175527c52ad2382196.tar.bz2 |
Merge "Security fix from Tavis Ormandy"
-rw-r--r-- | hw/dma.c | 8 |
1 files changed, 5 insertions, 3 deletions
@@ -345,9 +345,11 @@ static void channel_run (int ncont, int ichan) #endif r = dma_controllers[ncont].regs + ichan; - n = r->transfer_handler (r->opaque, ichan + (ncont << 2), - r->now[COUNT], (r->base[COUNT] + 1) << ncont); - r->now[COUNT] = n; + if (r->transfer_handler) { + n = r->transfer_handler (r->opaque, ichan + (ncont << 2), + r->now[COUNT], (r->base[COUNT] + 1) << ncont); + r->now[COUNT] = n; + } ldebug ("dma_pos %d size %d\n", n, (r->base[COUNT] + 1) << ncont); } |