--- at45db.c	2014-05-10 03:16:21.576179000 +0600
+++ at45db.c	2014-05-13 14:06:22.563031154 +0600
@@ -252,18 +252,20 @@ int spi_read_at45db(struct flashctx *fla
 
 	/* We have to split this up into chunks to fit within the programmer's read size limit, but those
 	 * chunks can cross page boundaries. */
 	const unsigned int max_data_read = flash->pgm->spi.max_data_read;
 	const unsigned int max_chunk = (max_data_read > 0) ? max_data_read : page_size;
-	while (addr < len) {
-		unsigned int chunk = min(max_chunk, len);
-		int ret = spi_nbyte_read(flash, at45db_convert_addr(addr, page_size), buf + addr, chunk);
+	const unsigned int end_addr = addr + len;
+	while (addr < end_addr) {
+		unsigned int chunk = min(max_chunk, end_addr - addr);
+		int ret = spi_nbyte_read(flash, at45db_convert_addr(addr, page_size), buf, chunk);
 		if (ret) {
 			msg_cerr("%s: error sending read command!\n", __func__);
 			return ret;
 		}
 		addr += chunk;
+		buf += chunk;
 	}
 
 	return 0;
 }
 
@@ -281,29 +283,31 @@ int spi_read_at45db_e8(struct flashctx *
 
 	/* We have to split this up into chunks to fit within the programmer's read size limit, but those
 	 * chunks can cross page boundaries. */
 	const unsigned int max_data_read = flash->pgm->spi.max_data_read;
 	const unsigned int max_chunk = (max_data_read > 0) ? max_data_read : page_size;
-	while (addr < len) {
+	const unsigned int end_addr = addr + len;
+	while (addr < end_addr) {
 		const unsigned int addr_at45 = at45db_convert_addr(addr, page_size);
 		const unsigned char cmd[] = {
 			AT45DB_READ_ARRAY,
 			(addr_at45 >> 16) & 0xff,
 			(addr_at45 >> 8) & 0xff,
 			(addr_at45 >> 0) & 0xff
 		};
 		/* We need to leave place for 4 dummy bytes and handle them explicitly. */
-		unsigned int chunk = min(max_chunk, len + 4);
+		unsigned int chunk = min(max_chunk, end_addr - addr + 4);
 		uint8_t tmp[chunk];
 		int ret = spi_send_command(flash, sizeof(cmd), chunk, cmd, tmp);
 		if (ret) {
 			msg_cerr("%s: error sending read command!\n", __func__);
 			return ret;
 		}
 		/* Copy result without dummy bytes into buf and advance address counter respectively. */
-		memcpy(buf + addr, tmp + 4, chunk - 4);
+		memcpy(buf, tmp + 4, chunk - 4);
 		addr += chunk - 4;
+		buf += chunk - 4;
 	}
 	return 0;
 }
 
 /* Returns 0 when ready, 1 on errors and timeouts. */
