Commit 65e4b9b0 authored by Fiodor Suietov's avatar Fiodor Suietov Committed by Len Brown

ACPICA: Fix for possible memory leak and fault.

Fixed a possible memory leak and fault in acpi_ex_resolve_object_to_value()
during a read from a buffer or region field. (BZ 458)
Signed-off-by: default avatarBob Moore <robert.moore@intel.com>
Signed-off-by: default avatarAlexey Starikovskiy <alexey.y.starikovskiy@intel.com>
Signed-off-by: default avatarLen Brown <len.brown@intel.com>
parent 867c9aec
...@@ -141,7 +141,7 @@ acpi_ex_resolve_object_to_value(union acpi_operand_object **stack_ptr, ...@@ -141,7 +141,7 @@ acpi_ex_resolve_object_to_value(union acpi_operand_object **stack_ptr,
acpi_status status = AE_OK; acpi_status status = AE_OK;
union acpi_operand_object *stack_desc; union acpi_operand_object *stack_desc;
void *temp_node; void *temp_node;
union acpi_operand_object *obj_desc; union acpi_operand_object *obj_desc = NULL;
u16 opcode; u16 opcode;
ACPI_FUNCTION_TRACE(ex_resolve_object_to_value); ACPI_FUNCTION_TRACE(ex_resolve_object_to_value);
...@@ -299,8 +299,6 @@ acpi_ex_resolve_object_to_value(union acpi_operand_object **stack_ptr, ...@@ -299,8 +299,6 @@ acpi_ex_resolve_object_to_value(union acpi_operand_object **stack_ptr,
status = acpi_ds_get_package_arguments(stack_desc); status = acpi_ds_get_package_arguments(stack_desc);
break; break;
/* These cases may never happen here, but just in case.. */
case ACPI_TYPE_BUFFER_FIELD: case ACPI_TYPE_BUFFER_FIELD:
case ACPI_TYPE_LOCAL_REGION_FIELD: case ACPI_TYPE_LOCAL_REGION_FIELD:
case ACPI_TYPE_LOCAL_BANK_FIELD: case ACPI_TYPE_LOCAL_BANK_FIELD:
...@@ -314,6 +312,10 @@ acpi_ex_resolve_object_to_value(union acpi_operand_object **stack_ptr, ...@@ -314,6 +312,10 @@ acpi_ex_resolve_object_to_value(union acpi_operand_object **stack_ptr,
status = status =
acpi_ex_read_data_from_field(walk_state, stack_desc, acpi_ex_read_data_from_field(walk_state, stack_desc,
&obj_desc); &obj_desc);
/* Remove a reference to the original operand, then override */
acpi_ut_remove_reference(*stack_ptr);
*stack_ptr = (void *)obj_desc; *stack_ptr = (void *)obj_desc;
break; break;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment