From c04a5fc3a41660700e215fce59eaa5781c207917 Mon Sep 17 00:00:00 2001
From: DrDoof <8052722+DrDoof@users.noreply.github.com>
Date: Sat, 12 Sep 2026 16:24:15 +0200
Subject: [PATCH] flash: bail out of a bulk read of zero length

flash_read_bulk() ends its copy loop only through the comparisons
len == 1|2|3|4, so a length of zero matches none of them. The
following len -= 4 wraps on uint16_t to 65532 and reaches 4 only
after 16384 iterations, writing 65536 bytes to the destination and
overwriting the whole XDATA space.

send_config() gets there with valid_len 0 whenever the stored
configuration begins with a NUL byte, which is the state left by
uploading an empty configuration file. Every later request for the
configuration page then clears the management VLAN and the STP
flag and replaces the host address, while the switch keeps running
and keeps forwarding traffic.
---
 rtl837x_flash.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/rtl837x_flash.c b/rtl837x_flash.c
index 5f04c88a..f18d21fb 100644
--- a/rtl837x_flash.c
+++ b/rtl837x_flash.c
@@ -222,6 +222,10 @@ void flash_read_jedecid(void)
 void flash_read_bulk(__xdata uint8_t *dst)
 {
 	short status;
+
+	if (!flash_region.len)
+		return;
+
 	flash_configure_sio();
 	while (flash_read_status() & STATUS_REG_BUSY_MASK);
 	flash_configure_mmio();