Emulation/switch-linux
1
0
Fork 0
mirror of https://github.com/fail0verflow/switch-linux.git synced 2025-05-04 02:34:21 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

ACPICA: Prevent possible allocation overrun during object copy

Browse source 
Original code did not handle the case where the object to be
copied was a namespace node.

Signed-off-by: Lin Ming <ming.m.lin@intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
This commit is contained in:
Lin Ming 2010-04-27 11:46:25 +08:00 • committed by Len Brown
parent 3fe50208b2
commit 17b82327f3
1 changed files with 11 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
drivers/acpi/acpica/utcopy.c
View file

@ -677,16 +677,24 @@ acpi_ut_copy_simple_object(union acpi_operand_object *source_desc,
u16 reference_count; u16 reference_count;
union acpi_operand_object *next_object; union acpi_operand_object *next_object;
acpi_status status; acpi_status status;
acpi_size copy_size;
/* Save fields from destination that we don't want to overwrite */ /* Save fields from destination that we don't want to overwrite */
reference_count = dest_desc->common.reference_count; reference_count = dest_desc->common.reference_count;
next_object = dest_desc->common.next_object; next_object = dest_desc->common.next_object;
/* Copy the entire source object over the destination object */ /*
* Copy the entire source object over the destination object.
* Note: Source can be either an operand object or namespace node.
*/
copy_size = sizeof(union acpi_operand_object);
if (ACPI_GET_DESCRIPTOR_TYPE(source_desc) == ACPI_DESC_TYPE_NAMED) {
copy_size = sizeof(struct acpi_namespace_node);
}
ACPI_MEMCPY((char *)dest_desc, (char *)source_desc, ACPI_MEMCPY(ACPI_CAST_PTR(char, dest_desc),
sizeof(union acpi_operand_object)); ACPI_CAST_PTR(char, source_desc), copy_size);
/* Restore the saved fields */ /* Restore the saved fields */