Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 65e4b9b0 authored by Fiodor Suietov's avatar Fiodor Suietov Committed by Len Brown
Browse files

ACPICA: Fix for possible memory leak and fault. 



Fixed a possible memory leak and fault in acpi_ex_resolve_object_to_value()
during a read from a buffer or region field. (BZ 458)

Signed-off-by: default avatarBob Moore <robert.moore@intel.com>
Signed-off-by: default avatarAlexey Starikovskiy <alexey.y.starikovskiy@intel.com>
Signed-off-by: default avatarLen Brown <len.brown@intel.com>
parent 867c9aec

drivers/acpi/executer/exresolv.c

+5 −3
Original line number Diff line number Diff line
@@ -141,7 +141,7 @@ acpi_ex_resolve_object_to_value(union acpi_operand_object **stack_ptr, 
	acpi_status status = AE_OK;

	union acpi_operand_object *stack_desc;

	void *temp_node;

	union acpi_operand_object *obj_desc;

	union acpi_operand_object *obj_desc = NULL;

	u16 opcode;



	ACPI_FUNCTION_TRACE(ex_resolve_object_to_value);
@@ -299,8 +299,6 @@ acpi_ex_resolve_object_to_value(union acpi_operand_object **stack_ptr, 
		status = acpi_ds_get_package_arguments(stack_desc);

		break;



		/* These cases may never happen here, but just in case.. */



	case ACPI_TYPE_BUFFER_FIELD:

	case ACPI_TYPE_LOCAL_REGION_FIELD:

	case ACPI_TYPE_LOCAL_BANK_FIELD:
@@ -314,6 +312,10 @@ acpi_ex_resolve_object_to_value(union acpi_operand_object **stack_ptr, 
		status =

		    acpi_ex_read_data_from_field(walk_state, stack_desc,

						 &obj_desc);



		/* Remove a reference to the original operand, then override */



		acpi_ut_remove_reference(*stack_ptr);

		*stack_ptr = (void *)obj_desc;

		break;