提交 1a57b1a3 编写于 作者: Z Zhen Lei 提交者: Dan Williams

ACPI/nfit: avoid accessing uninitialized memory in acpi_nfit_ctl()

The ACPI_ALLOCATE() does not zero the "buf", so when the condition
"integer->type != ACPI_TYPE_INTEGER" in int_to_buf() is met, the result
is unpredictable in acpi_nfit_ctl().
Signed-off-by: NZhen Lei <thunder.leizhen@huawei.com>
Reviewed-by: NDan Williams <dan.j.williams@intel.com>
Link: https://lore.kernel.org/r/20201118073517.1884-1-thunder.leizhen@huawei.comSigned-off-by: NDan Williams <dan.j.williams@intel.com>
上级 09162bc3
......@@ -282,18 +282,19 @@ static union acpi_object *pkg_to_buf(union acpi_object *pkg)
static union acpi_object *int_to_buf(union acpi_object *integer)
{
union acpi_object *buf = ACPI_ALLOCATE(sizeof(*buf) + 4);
union acpi_object *buf = NULL;
void *dst = NULL;
if (!buf)
goto err;
if (integer->type != ACPI_TYPE_INTEGER) {
WARN_ONCE(1, "BIOS bug, unexpected element type: %d\n",
integer->type);
goto err;
}
buf = ACPI_ALLOCATE(sizeof(*buf) + 4);
if (!buf)
goto err;
dst = buf + 1;
buf->type = ACPI_TYPE_BUFFER;
buf->buffer.length = 4;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册