[PATCH v1 19/30] ACPICA: executer: Fix NULL pointer dereference in AcpiExStoreObjectToIndex()

[Pawel Chmielewski]

From: Maciej Wieczor-Retman <maciej.wieczor-retman@xxxxxxxxx>

Fix a possible NULL pointer dereference when trying to store an empty
buffer into an indexed string or buffer. Source-buffers are only
allocated if the Length is non-zero.

Similarly to AcpiExConvertToInteger() reject empty buffers with an
error.

Link: https://github.com/acpica/acpica/commit/077d74a42549
Reported-by: Dot Slash <jyjuykuytweg@xxxxxxxxx>
Closes: https://github.com/open-acpica/acpica/issues/1193
Signed-off-by: Maciej Wieczor-Retman <maciej.wieczor-retman@xxxxxxxxx>
Signed-off-by: Pawel Chmielewski <pawel.chmielewski@xxxxxxxxx>
---
 drivers/acpi/acpica/exstore.c | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/drivers/acpi/acpica/exstore.c b/drivers/acpi/acpica/exstore.c
index 86be6bce1648..cd60fc366b08 100644
--- a/drivers/acpi/acpica/exstore.c
+++ b/drivers/acpi/acpica/exstore.c
@@ -295,13 +295,29 @@ acpi_ex_store_object_to_index(union acpi_operand_object *source_desc,
 			break;
 
 		case ACPI_TYPE_BUFFER:
-		case ACPI_TYPE_STRING:
 
-			/* Note: Takes advantage of common string/buffer fields */
+			/*
+			 * A zero-length buffer has no first element and a NULL
+			 * Pointer (see acpi_ut_create_buffer_object). Reject it, as is
+			 * done for the buffer-to-integer conversion.
+			 */
+			if (!source_desc->buffer.length) {
+				ACPI_BIOS_EXCEPTION((
+					AE_INFO, AE_AML_BUFFER_LIMIT,
+					"Source is a zero-length buffer, no data to store"));
+				return_ACPI_STATUS(AE_AML_BUFFER_LIMIT);
+			}
 
 			value = source_desc->buffer.pointer[0];
 			break;
 
+		case ACPI_TYPE_STRING:
+
+			/* A String always has a pointer; a null string stores a zero */
+
+			value = (u8)source_desc->string.pointer[0];
+			break;
+
 		default:
 
 			/* All other types are invalid */
-- 
2.50.1