⬢ DragonFlyBSD Kernel Audit
DF-3793 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/acpica/acpi.c
+++ b/sys/dev/acpica/acpi.c
@@ -2172,11 +2172,17 @@
      * Assume that what we've been pointed at is an Integer object, or
      * a method that will return an Integer.
      */
+    memset(&param, 0, sizeof(param));
     buf.Pointer = &param;
     buf.Length = sizeof(param);
     status = AcpiEvaluateObject(handle, path, NULL, &buf);
     if (ACPI_SUCCESS(status)) {
-	if (param.Type == ACPI_TYPE_INTEGER)
+	/* ACPICA leaves the caller buffer untouched (and sets Length to 0)
+	 * when the object exists but evaluation produced no return value;
+	 * do not interpret stale stack data as an object. */
+	if (buf.Length == 0) {
+	    status = AE_AML_NO_RETURN_VALUE;
+	} else if (param.Type == ACPI_TYPE_INTEGER)
 	    *number = param.Integer.Value;
 	else
 	    status = AE_TYPE;