⬢ DragonFlyBSD Kernel Audit
DF-5073 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/acpica/acpi.c
+++ b/sys/dev/acpica/acpi.c
@@ -2172,11 +2172,14 @@ acpi_GetInteger(ACPI_HANDLE handle, char *path, UINT32 *number)
     /*
      * Assume that what we've been pointed at is an Integer object, or
      * a method that will return an Integer.
      */
     buf.Pointer = &param;
     buf.Length = sizeof(param);
+    /* DF-5073/DF-3793: a method that returns nothing leaves buf.Pointer
+     * untouched on AE_OK (nsxfeval.c:541-545), so `param' would otherwise
+     * be read uninitialized below.  Pre-set the type to ACPI_TYPE_ANY so
+     * such evaluations correctly yield AE_TYPE without touching *number. */
+    param.Type = ACPI_TYPE_ANY;
     status = AcpiEvaluateObject(handle, path, NULL, &buf);
     if (ACPI_SUCCESS(status)) {
 	if (param.Type == ACPI_TYPE_INTEGER)
 	    *number = param.Integer.Value;
 	else