This does not happen during normal usage, but can occur if the guest issues an invalid ESP command sequence.
Reported-by: Chuhong Yuan <hsleste...@gmail.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayl...@ilande.co.uk> --- hw/scsi/esp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c index 55143a1208..0050493e18 100644 --- a/hw/scsi/esp.c +++ b/hw/scsi/esp.c @@ -431,7 +431,7 @@ static int esp_cdb_length(ESPState *s) int cmdlen, len; cmdlen = fifo8_num_used(&s->cmdfifo); - if (cmdlen < s->cmdfifo_cdb_offset) { + if (cmdlen == 0 || cmdlen < s->cmdfifo_cdb_offset) { return 0; } -- 2.39.2