ACPICA: Resources: Fix loop termination for the get AML length function.
authorLv Zheng <lv.zheng@intel.com>
Thu, 21 Nov 2013 04:17:34 +0000 (12:17 +0800)
committerRafael J. Wysocki <rafael.j.wysocki@intel.com>
Thu, 21 Nov 2013 12:47:04 +0000 (13:47 +0100)
The loop terminates on a NULL resource pointer, which can never
happen since the loop simply increments a valid resource pointer.
This fix changes the loop to terminate on an end-of-buffer condition.

Problem can be seen by callers to AcpiSetCurrentResources with an
invalid or corrupted resource descriptor; or a resource descriptor
without an END_TAG descriptor.

(refined by Bob Moore)
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
drivers/acpi/acpica/acresrc.h
drivers/acpi/acpica/rscalc.c
drivers/acpi/acpica/rscreate.c
drivers/acpi/acpica/rsutils.c

Simple merge
Simple merge
Simple merge
Simple merge