Signed-off-by: Peter Xu <pet...@redhat.com>
---
hw/usb/hcd-xhci.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 44b6f8c..d15918f 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -698,11 +698,13 @@ static inline void xhci_dma_write_u32s(XHCIState *xhci,
dma_addr_t addr,
uint32_t *buf, size_t len)
{
int i;
- uint32_t tmp[len / sizeof(uint32_t)];
+ uint32_t tmp[12];
+ uint32_t n = len / sizeof(uint32_t);
assert((len % sizeof(uint32_t)) == 0);
+ assert(n <= ARRAY_SIZE(tmp));
- for (i = 0; i < (len / sizeof(uint32_t)); i++) {
+ for (i = 0; i < n; i++) {
tmp[i] = cpu_to_le32(buf[i]);
}
pci_dma_write(PCI_DEVICE(xhci), addr, tmp, len);
--
2.4.3
