diff options
| author | Robert Moore <Robert.Moore@intel.com> | 2013-11-08 14:00:17 -0800 |
|---|---|---|
| committer | Robert Moore <Robert.Moore@intel.com> | 2013-11-08 14:00:17 -0800 |
| commit | e685384381e3bea336721fb9c2c344d149153a76 (patch) | |
| tree | bf0dc3c386cc66e1b9bff5f9d6397d9625535e0e /source/include/acresrc.h | |
| parent | ef9997164ab19f5ecc40951733796b01616782da (diff) | |
| download | acpica-e685384381e3bea336721fb9c2c344d149153a76.tar.gz | |
Resources: Fix loop termination for the get AML length function.
The loop terminates on a NULL resource pointer, which can never happen
since the loop simply increments a valid resource pointer. This fix
changes the loop to terminate on an end-of-buffer condition.
Problem can be seen by callers to AcpiSetCurrentResources with an invalid
or corrupted resource descriptor; or a resource descriptor without an
END_TAG descriptor.
Reported by Dan Carpenter <dan.carpenter@oracle.com>. Fixed by
Lv Zheng, Bob Moore.
Diffstat (limited to 'source/include/acresrc.h')
| -rw-r--r-- | source/include/acresrc.h | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/source/include/acresrc.h b/source/include/acresrc.h index 0c51c152b..12e445104 100644 --- a/source/include/acresrc.h +++ b/source/include/acresrc.h @@ -270,7 +270,7 @@ AcpiRsCreateResourceList ( ACPI_STATUS AcpiRsCreateAmlResources ( - ACPI_RESOURCE *LinkedListBuffer, + ACPI_BUFFER *ResourceList, ACPI_BUFFER *OutputBuffer); ACPI_STATUS @@ -324,7 +324,8 @@ AcpiRsGetListLength ( ACPI_STATUS AcpiRsGetAmlLength ( - ACPI_RESOURCE *LinkedListBuffer, + ACPI_RESOURCE *ResourceList, + ACPI_SIZE ResourceListSize, ACPI_SIZE *SizeNeeded); ACPI_STATUS |