[tfaber] 69899: [ACPI] - Addendum to r69867: free device info pointer at the end of acpi_bus_add to avoid use after free. Powered by Special Pool

Author: tfaber
Date: Mon Nov 16 14:20:25 2015
New Revision: 69899

URL: http://svn.reactos.org/svn/reactos?rev=69899&view=rev
Log:
[ACPI]
- Addendum to r69867: free device info pointer at the end of acpi_bus_add to avoid use after free.
Powered by Special Pool

Modified:
    trunk/reactos/drivers/bus/acpi/busmgr/bus.c

Modified: trunk/reactos/drivers/bus/acpi/busmgr/bus.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/bus/acpi/busmgr/bus...
==============================================================================
--- trunk/reactos/drivers/bus/acpi/busmgr/bus.c	[iso-8859-1] (original)
+++ trunk/reactos/drivers/bus/acpi/busmgr/bus.c	[iso-8859-1] Mon Nov 16 14:20:25 2015
@@ -1138,7 +1138,7 @@
    struct acpi_device	*device = NULL;
    char			bus_id[5] = {'?',0};
    ACPI_BUFFER	buffer;
-	ACPI_DEVICE_INFO	*info;
+	ACPI_DEVICE_INFO	*info = NULL;
    char			*hid = NULL;
    char			*uid = NULL;
    ACPI_PNP_DEVICE_ID_LIST *cid_list = NULL;
@@ -1248,6 +1248,7 @@
    		ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
    			"Error reading device info\n"));
    		result = AE_NOT_FOUND;
+			info = NULL;
    		goto end;
    	}
    	if (info->Valid & ACPI_VALID_HID)
@@ -1266,7 +1267,6 @@
    		device->pnp.bus_address = info->Address;
    		device->flags.bus_address = 1;
    	}
-		ACPI_FREE(info);
    	break;
    case ACPI_BUS_TYPE_POWER:
    	hid = ACPI_POWER_HID;
@@ -1427,6 +1427,8 @@
    	acpi_bus_find_driver(device);

end:
+	if (info != NULL)
+		ACPI_FREE(info);
    if (result) {
    	if (device->pnp.cid_list) {
    		ExFreePoolWithTag(device->pnp.cid_list, 'DpcA');