Emulation/switch-coreboot
1
0
Fork 0
mirror of https://github.com/fail0verflow/switch-coreboot.git synced 2025-05-04 01:39:18 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

libpayload: avoid use-after-free in OHCI driver

Browse source 
Change-Id: I89294c22c57564262e53e36c5ae9ac6eb0ed934a
Signed-off-by: Patrick Georgi <patrick@georgi-clan.de>
Found-by: Coverity Scan
Reviewed-on: http://review.coreboot.org/8510
Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net>
Reviewed-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Tested-by: build bot (Jenkins)
This commit is contained in:
Patrick Georgi 2015-02-22 16:49:10 +01:00 • committed by Patrick Georgi
parent 477b4c539a
commit a6c7ae7014
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
payloads/libpayload/drivers/usb/ohci.c
View file

@ -854,12 +854,12 @@ ohci_process_done_queue(ohci_t *const ohci, const int spew_debug)
/* Free this TD, and */ /* Free this TD, and */
free(td); free(td);
--intrq->remaining_tds; --intrq->remaining_tds;
/* the interrupt queue if it has no more TDs. */
if (!intrq->remaining_tds)
free(intrq);
usb_debug("Freed TD from orphaned interrupt " usb_debug("Freed TD from orphaned interrupt "
"queue, %d TDs remain.\n", "queue, %d TDs remain.\n",
intrq->remaining_tds); intrq->remaining_tds);
/* the interrupt queue if it has no more TDs. */
if (!intrq->remaining_tds)
free(intrq);
} else { } else {
/* Save done TD to be processed. */ /* Save done TD to be processed. */
td->next = temp_tdq; td->next = temp_tdq;