[ldv-project] [PATCH] exstore.c/exoparg.c: Add null-check on return_desc->pointer use.

[Markov Gleb]

If the requested length is == 0,
then the length variable will be set to == 0.

Call of acpi_ex_opcode_3A_1T_1R in exoparg3.c
with length == 0 may lead a skip of code block
with buffer initialization so usage of any
buffer fields will lead to dereference of null.

The problem occurs when calling acpi_ex_store
with return_desc as the first parameter.

Added null check to exstore.c to avoid
dereferencing.
Make status change on uninitialized buffer.
If the solution is trivial, this section can be omitted.
Not tried to initialize the buffer again.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Markov Gleb <markov.gi at npc-ksb.ru>
---
 drivers/acpi/acpica/exstore.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/acpi/acpica/exstore.c b/drivers/acpi/acpica/exstore.c
index cbc42207496d..791ecf89d71c 100644
--- a/drivers/acpi/acpica/exstore.c
+++ b/drivers/acpi/acpica/exstore.c
@@ -299,6 +299,12 @@ acpi_ex_store_object_to_index(union acpi_operand_object *source_desc,
 
 			/* Note: Takes advantage of common string/buffer fields */
 
+			if (source_desc->buffer.pointer == NULL ||
+			    source_desc->buffer.length == 0) {
+				status = AE_BAD_PARAMETER;
+				break;
+			}
+
 			value = source_desc->buffer.pointer[0];
 			break;
 
-- 
2.43.0