[PATCH] platform/x86: toshiba_acpi: validate ACPI object type in tci_raw()

[Tristan Madani]

tci_raw() calls acpi_evaluate_object() and uses the returned buffer as
an ACPI_TYPE_PACKAGE without checking its type field. If the ACPI method
returns a different object type, accessing package.count and
package.elements interprets whatever data the union holds as a package
descriptor.

Add a type check before accessing the package fields. Return AE_TYPE
when the result is not a package, when the package has more elements
than TCI_WORDS, or when any element is not an ACPI_TYPE_INTEGER.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
---
 drivers/platform/x86/toshiba_acpi.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
index a0b8060836d01..4ccc8f51c3a5b 100644
--- a/drivers/platform/x86/toshiba_acpi.c
+++ b/drivers/platform/x86/toshiba_acpi.c
@@ -342,9 +342,20 @@ static acpi_status tci_raw(struct toshiba_acpi_dev *dev,
 	status = acpi_evaluate_object(dev->acpi_dev->handle,
 				      (char *)dev->method_hci, &params,
 				      &results);
-	if ((status == AE_OK) && (out_objs->package.count <= TCI_WORDS)) {
-		for (i = 0; i < out_objs->package.count; ++i)
-			out[i] = out_objs->package.elements[i].integer.value;
+	if (status == AE_OK) {
+		if (out_objs->type == ACPI_TYPE_PACKAGE &&
+		    out_objs->package.count <= TCI_WORDS) {
+			for (i = 0; i < out_objs->package.count; ++i) {
+				if (out_objs->package.elements[i].type !=
+				    ACPI_TYPE_INTEGER) {
+					status = AE_TYPE;
+					break;
+				}
+				out[i] = out_objs->package.elements[i].integer.value;
+			}
+		} else {
+			status = AE_TYPE;
+		}
 	}
 
 	return status;
-- 
2.47.3