GNUBoot
/
coreboot-kgpe-d16
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

libpayload: avoid use-after-free in OHCI driver 

Change-Id: I89294c22c57564262e53e36c5ae9ac6eb0ed934a
Signed-off-by: Patrick Georgi <patrick@georgi-clan.de>
Found-by: Coverity Scan
Reviewed-on: http://review.coreboot.org/8510
Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net>
Reviewed-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Tested-by: build bot (Jenkins)
This commit is contained in:
Patrick Georgi 2015-02-22 16:49:10 +01:00 committed by Patrick Georgi
parent 477b4c539a
commit a6c7ae7014
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
payloads/libpayload/drivers/usb/ohci.c
View File

@ -854,12 +854,12 @@ ohci_process_done_queue(ohci_t *const ohci, const int spew_debug)
/* Free this TD, and */
free(td);
--intrq->remaining_tds;
/* the interrupt queue if it has no more TDs. */
if (!intrq->remaining_tds)
free(intrq);
usb_debug("Freed TD from orphaned interrupt "
"queue, %d TDs remain.\n",
intrq->remaining_tds);
/* the interrupt queue if it has no more TDs. */
if (!intrq->remaining_tds)
free(intrq);
} else {
/* Save done TD to be processed. */
td->next = temp_tdq;