mirrors/acpica
1
0
Fork 0
mirror of https://github.com/acpica/acpica/ synced 2024-12-31 22:54:28 +03:00
Code Issues Packages Projects Releases Wiki Activity

Prevent possible allocation overrun during object copy.

Browse Source 
Original code did not handle the case where the object to be
copied was a namespace node.
This commit is contained in:
Robert Moore 2010-04-09 12:47:44 -07:00
parent c2e293f281
commit 681f8f4e6b
1 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
source/components/utilities/utcopy.c
View File

@ -797,6 +797,7 @@ AcpiUtCopySimpleObject (
UINT16 ReferenceCount;
ACPI_OPERAND_OBJECT *NextObject;
ACPI_STATUS Status;
ACPI_SIZE CopySize;
/* Save fields from destination that we don't want to overwrite */
@ -804,10 +805,18 @@ AcpiUtCopySimpleObject (
ReferenceCount = DestDesc->Common.ReferenceCount;
NextObject = DestDesc->Common.NextObject;
/* Copy the entire source object over the destination object*/
/*
* Copy the entire source object over the destination object.
* Note: Source can be either an operand object or namespace node.
*/
CopySize = sizeof (ACPI_OPERAND_OBJECT);
if (ACPI_GET_DESCRIPTOR_TYPE (SourceDesc) == ACPI_DESC_TYPE_NAMED)
{
CopySize = sizeof (ACPI_NAMESPACE_NODE);
}
ACPI_MEMCPY ((char *) DestDesc, (char *) SourceDesc,
sizeof (ACPI_OPERAND_OBJECT));
ACPI_MEMCPY (ACPI_CAST_PTR (char, DestDesc),
ACPI_CAST_PTR (char, SourceDesc), CopySize);
/* Restore the saved fields */
@ -841,8 +850,7 @@ AcpiUtCopySimpleObject (
/* Copy the actual buffer data */
ACPI_MEMCPY (DestDesc->Buffer.Pointer,
SourceDesc->Buffer.Pointer,
SourceDesc->Buffer.Length);
SourceDesc->Buffer.Pointer, SourceDesc->Buffer.Length);
}
break;
@ -864,7 +872,7 @@ AcpiUtCopySimpleObject (
/* Copy the actual string data */
ACPI_MEMCPY (DestDesc->String.Pointer, SourceDesc->String.Pointer,
(ACPI_SIZE) SourceDesc->String.Length + 1);
(ACPI_SIZE) SourceDesc->String.Length + 1);
}
break;