From e0df37f359e6b2be8a7df8d9846f9cd03130511e Mon Sep 17 00:00:00 2001
From: DrDoof <8052722+DrDoof@users.noreply.github.com>
Date: Sat, 12 Sep 2026 18:34:59 +0200
Subject: [PATCH] flash: bail out of a security-register read of zero length

flash_read_security() ends its loop the same way flash_read_bulk() did
before the previous commit: only through comparisons with 1, 2, 3 and 4. A length of
zero matches none of them, the following subtraction wraps on uint16_t
and the loop keeps printing until the counter comes back down to 4.

No caller passes zero today, since the only one is the CLI with a
constant length of 40, but the bound belongs in the function rather
than in whoever calls it.
---
 rtl837x_flash.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/rtl837x_flash.c b/rtl837x_flash.c
index f18d21fb..3805d730 100644
--- a/rtl837x_flash.c
+++ b/rtl837x_flash.c
@@ -262,6 +262,9 @@ void flash_read_bulk(__xdata uint8_t *dst)
 
 void flash_read_security(void)
 {
+	if (!flash_region.len)
+		return;
+
 	flash_configure_sio();
 
 	while (flash_read_status() & STATUS_REG_BUSY_MASK);