flash: bail out of a bulk read of zero length

flash_read_bulk() ends its copy loop only through the comparisons
len == 1|2|3|4, so a length of zero matches none of them. The
following len -= 4 wraps on uint16_t to 65532 and reaches 4 only
after 16384 iterations, writing 65536 bytes to the destination and
overwriting the whole XDATA space.

send_config() gets there with valid_len 0 whenever the stored
configuration begins with a NUL byte, which is the state left by
uploading an empty configuration file. Every later request for the
configuration page then clears the management VLAN and the STP
flag and replaces the host address, while the switch keeps running
and keeps forwarding traffic.

rtl837x_flash.c

@@ -222,6 +222,10 @@ void flash_read_jedecid(void)
 void flash_read_bulk(__xdata uint8_t *dst)
 {
 	short status;
+
+	if (!flash_region.len)
+		return;
+
 	flash_configure_sio();
 	while (flash_read_status() & STATUS_REG_BUSY_MASK);
 	flash_configure_mmio();