a5bd9f6
From c96f4909ef077ca8a1b8a5db356ed290e6177b5f Mon Sep 17 00:00:00 2001
a5bd9f6
From: Nickolai Zeldovich <nickolai@csail.mit.edu>
a5bd9f6
Date: Thu, 7 Mar 2013 08:52:29 +0100
a5bd9f6
Subject: [PATCH 197/364] 	* grub-core/commands/acpi.c
a5bd9f6
 (grub_acpi_create_ebda): Don't 	dereference null pointer. While the
a5bd9f6
 code is technically correct, gcc 	may eliminate a null check if pointer
a5bd9f6
 is already dereferenced.
a5bd9f6
a5bd9f6
---
a5bd9f6
 ChangeLog                 | 6 ++++++
a5bd9f6
 grub-core/commands/acpi.c | 7 ++++---
a5bd9f6
 2 files changed, 10 insertions(+), 3 deletions(-)
a5bd9f6
a5bd9f6
diff --git a/ChangeLog b/ChangeLog
a5bd9f6
index ca3d603..5fb9b77 100644
a5bd9f6
--- a/ChangeLog
a5bd9f6
+++ b/ChangeLog
a5bd9f6
@@ -1,5 +1,11 @@
a5bd9f6
 2013-03-07  Nickolai Zeldovich <nickolai@csail.mit.edu>
a5bd9f6
 
a5bd9f6
+	* grub-core/commands/acpi.c (grub_acpi_create_ebda): Don't
a5bd9f6
+	dereference null pointer. While the code is technically correct, gcc
a5bd9f6
+	may eliminate a null check if pointer is already dereferenced.
a5bd9f6
+
a5bd9f6
+2013-03-07  Nickolai Zeldovich <nickolai@csail.mit.edu>
a5bd9f6
+
a5bd9f6
 	* grub-core/normal/crypto.c (read_crypto_list): Fix incorrect
a5bd9f6
 	OOM check.
a5bd9f6
 	* grub-core/normal/term.c (read_terminal_list): Likewise.
a5bd9f6
diff --git a/grub-core/commands/acpi.c b/grub-core/commands/acpi.c
a5bd9f6
index 891e392..8000873 100644
a5bd9f6
--- a/grub-core/commands/acpi.c
a5bd9f6
+++ b/grub-core/commands/acpi.c
a5bd9f6
@@ -171,7 +171,7 @@ grub_acpi_create_ebda (void)
a5bd9f6
   struct grub_acpi_create_ebda_ctx ctx = {
a5bd9f6
     .highestlow = 0
a5bd9f6
   };
a5bd9f6
-  int ebda_kb_len;
a5bd9f6
+  int ebda_kb_len = 0;
a5bd9f6
   int mmapregion = 0;
a5bd9f6
   grub_uint8_t *ebda, *v1inebda = 0, *v2inebda = 0;
a5bd9f6
   grub_uint8_t *targetebda, *target;
a5bd9f6
@@ -179,8 +179,9 @@ grub_acpi_create_ebda (void)
a5bd9f6
   struct grub_acpi_rsdp_v20 *v2;
a5bd9f6
 
a5bd9f6
   ebda = (grub_uint8_t *) (grub_addr_t) ((*((grub_uint16_t *)0x40e)) << 4);
a5bd9f6
-  ebda_kb_len = *(grub_uint16_t *) ebda;
a5bd9f6
-  if (! ebda || ebda_kb_len > 16)
a5bd9f6
+  if (ebda)
a5bd9f6
+    ebda_kb_len = *(grub_uint16_t *) ebda;
a5bd9f6
+  if (ebda_kb_len > 16)
a5bd9f6
     ebda_kb_len = 0;
a5bd9f6
   ctx.ebda_len = (ebda_kb_len + 1) << 10;
a5bd9f6
 
a5bd9f6
-- 
a5bd9f6
1.8.1.4
a5bd9f6