When a all 0xFF buffer is passed to drop_ffs, the no-0xFF check loop will loop forever. After the fix, If ssize_t i = -1 and size_t l = i + 1, the value of l will still be 0 as expected.

Signed-off-by: Tao Hou hotforest@gmail.com Cc: Ben Gardiner bengardiner@nanometrics.ca Cc: Scott Wood scottwood@freescale.com --- drivers/mtd/nand/nand_util.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/nand_util.c b/drivers/mtd/nand/nand_util.c index ff2d348..de1d13e 100644 --- a/drivers/mtd/nand/nand_util.c +++ b/drivers/mtd/nand/nand_util.c @@ -451,7 +451,8 @@ static int check_skip_len(nand_info_t *nand, loff_t offset, size_t length) static size_t drop_ffs(const nand_info_t *nand, const u_char *buf, const size_t *len) { - size_t i, l = *len; + size_t l = *len; + ssize_t i;

for (i = l - 1; i >= 0; i--) if (buf[i] != 0xFF)