ACPICA: Resources: Fix loop termination for the get AML length function.
authorLv Zheng <lv.zheng@intel.com>
Thu, 21 Nov 2013 04:17:34 +0000 (12:17 +0800)
committerRafael J. Wysocki <rafael.j.wysocki@intel.com>
Thu, 21 Nov 2013 12:47:04 +0000 (13:47 +0100)
commit9a0a35972591f91167556b4a61673d08ef07f310
tree81dc770c8618c8a8e5f6a147592cdd7a79b18565
parentc38f671e390fe0d1605b402a28b01b1dbf8e10b3
ACPICA: Resources: Fix loop termination for the get AML length function.

The loop terminates on a NULL resource pointer, which can never
happen since the loop simply increments a valid resource pointer.
This fix changes the loop to terminate on an end-of-buffer condition.

Problem can be seen by callers to AcpiSetCurrentResources with an
invalid or corrupted resource descriptor; or a resource descriptor
without an END_TAG descriptor.

(refined by Bob Moore)
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
drivers/acpi/acpica/acresrc.h
drivers/acpi/acpica/rscalc.c
drivers/acpi/acpica/rscreate.c
drivers/acpi/acpica/rsutils.c