[ros-diffs] [tfaber] 69899: [ACPI] - Addendum to r69867: free device info pointer at the end of acpi_bus_add to avoid use after free. Powered by Special Pool

Author: tfaber
Date: Mon Nov 16 14:20:25 2015
New Revision: 69899

URL: http://svn.reactos.org/svn/reactos?rev=69899&view=rev
Log:
[ACPI]
- Addendum to r69867: free device info pointer at the end of acpi_bus_add to avoid use
after free.
Powered by Special Pool

Modified:
    trunk/reactos/drivers/bus/acpi/busmgr/bus.c

Modified: trunk/reactos/drivers/bus/acpi/busmgr/bus.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/bus/acpi/busmgr/bu…
==============================================================================
--- trunk/reactos/drivers/bus/acpi/busmgr/bus.c	[iso-8859-1] (original)
+++ trunk/reactos/drivers/bus/acpi/busmgr/bus.c	[iso-8859-1] Mon Nov 16 14:20:25 2015
@@ -1138,7 +1138,7 @@
 	struct acpi_device	*device = NULL;
 	char			bus_id[5] = {'?',0};
 	ACPI_BUFFER	buffer;
-	ACPI_DEVICE_INFO	*info;
+	ACPI_DEVICE_INFO	*info = NULL;
 	char			*hid = NULL;
 	char			*uid = NULL;
 	ACPI_PNP_DEVICE_ID_LIST *cid_list = NULL;
@@ -1248,6 +1248,7 @@
 			ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
 				"Error reading device info\n"));
 			result = AE_NOT_FOUND;
+			info = NULL;
 			goto end;
 		}
 		if (info->Valid & ACPI_VALID_HID)
@@ -1266,7 +1267,6 @@
 			device->pnp.bus_address = info->Address;
 			device->flags.bus_address = 1;
 		}
-		ACPI_FREE(info);
 		break;
 	case ACPI_BUS_TYPE_POWER:
 		hid = ACPI_POWER_HID;
@@ -1427,6 +1427,8 @@
 		acpi_bus_find_driver(device);
 
 end:
+	if (info != NULL)
+		ACPI_FREE(info);
 	if (result) {
 		if (device->pnp.cid_list) {
 			ExFreePoolWithTag(device->pnp.cid_list, 'DpcA');