mirrors/acpica
1
0
Fork 0
mirror of https://github.com/acpica/acpica/ synced 2025-01-05 17:14:27 +03:00
Code Issues Packages Projects Releases Wiki Activity

Prevent possible allocation overrun during object copy.

Browse Source 
Original code did not handle the case where the object to be
copied was a namespace node.
This commit is contained in:
Robert Moore 2010-04-09 12:47:44 -07:00
parent c2e293f281
commit 681f8f4e6b
1 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
source/components/utilities/utcopy.c
View File

@ -797,6 +797,7 @@ AcpiUtCopySimpleObject (
UINT16 ReferenceCount; UINT16 ReferenceCount;
ACPI_OPERAND_OBJECT *NextObject; ACPI_OPERAND_OBJECT *NextObject;
ACPI_STATUS Status; ACPI_STATUS Status;
ACPI_SIZE CopySize;
/* Save fields from destination that we don't want to overwrite */ /* Save fields from destination that we don't want to overwrite */
@ -804,10 +805,18 @@ AcpiUtCopySimpleObject (
ReferenceCount = DestDesc->Common.ReferenceCount; ReferenceCount = DestDesc->Common.ReferenceCount;
NextObject = DestDesc->Common.NextObject; NextObject = DestDesc->Common.NextObject;
/* Copy the entire source object over the destination object*/ /*
* Copy the entire source object over the destination object.
* Note: Source can be either an operand object or namespace node.
*/
CopySize = sizeof (ACPI_OPERAND_OBJECT);
if (ACPI_GET_DESCRIPTOR_TYPE (SourceDesc) == ACPI_DESC_TYPE_NAMED)
{
CopySize = sizeof (ACPI_NAMESPACE_NODE);
}
ACPI_MEMCPY ((char *) DestDesc, (char *) SourceDesc, ACPI_MEMCPY (ACPI_CAST_PTR (char, DestDesc),
sizeof (ACPI_OPERAND_OBJECT)); ACPI_CAST_PTR (char, SourceDesc), CopySize);
/* Restore the saved fields */ /* Restore the saved fields */
@ -841,8 +850,7 @@ AcpiUtCopySimpleObject (
/* Copy the actual buffer data */ /* Copy the actual buffer data */
ACPI_MEMCPY (DestDesc->Buffer.Pointer, ACPI_MEMCPY (DestDesc->Buffer.Pointer,
SourceDesc->Buffer.Pointer, SourceDesc->Buffer.Pointer, SourceDesc->Buffer.Length);
SourceDesc->Buffer.Length);
} }
break; break;