diff options
| author | Fiodor Suietov <fiodor.f.suietov@intel.com> | 2007-02-02 16:48:21 (GMT) |
|---|---|---|
| committer | Len Brown <len.brown@intel.com> | 2007-02-03 02:14:26 (GMT) |
| commit | 65e4b9b05dc10ee84b5c9fc3039fbcc6863743d7 (patch) | |
| tree | 12ae5917d0343423adeff6624df0c4f273fffac2 /drivers/acpi | |
| parent | 867c9aec576e0c0d89dfa3922019320619002129 (diff) | |
| download | linux-65e4b9b05dc10ee84b5c9fc3039fbcc6863743d7.tar.xz | |
ACPICA: Fix for possible memory leak and fault.
Fixed a possible memory leak and fault in acpi_ex_resolve_object_to_value()
during a read from a buffer or region field. (BZ 458)
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Alexey Starikovskiy <alexey.y.starikovskiy@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Diffstat (limited to 'drivers/acpi')
| -rw-r--r-- | drivers/acpi/executer/exresolv.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/acpi/executer/exresolv.c b/drivers/acpi/executer/exresolv.c index 6499de8..fa17f55 100644 --- a/drivers/acpi/executer/exresolv.c +++ b/drivers/acpi/executer/exresolv.c @@ -141,7 +141,7 @@ acpi_ex_resolve_object_to_value(union acpi_operand_object **stack_ptr, acpi_status status = AE_OK; union acpi_operand_object *stack_desc; void *temp_node; - union acpi_operand_object *obj_desc; + union acpi_operand_object *obj_desc = NULL; u16 opcode; ACPI_FUNCTION_TRACE(ex_resolve_object_to_value); @@ -299,8 +299,6 @@ acpi_ex_resolve_object_to_value(union acpi_operand_object **stack_ptr, status = acpi_ds_get_package_arguments(stack_desc); break; - /* These cases may never happen here, but just in case.. */ - case ACPI_TYPE_BUFFER_FIELD: case ACPI_TYPE_LOCAL_REGION_FIELD: case ACPI_TYPE_LOCAL_BANK_FIELD: @@ -314,6 +312,10 @@ acpi_ex_resolve_object_to_value(union acpi_operand_object **stack_ptr, status = acpi_ex_read_data_from_field(walk_state, stack_desc, &obj_desc); + + /* Remove a reference to the original operand, then override */ + + acpi_ut_remove_reference(*stack_ptr); *stack_ptr = (void *)obj_desc; break; |