diff options
Diffstat (limited to 'drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c')
| -rw-r--r-- | drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c | 39 |
1 files changed, 34 insertions, 5 deletions
diff --git a/drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c b/drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c index 091e48c217ed..8cc212c85266 100644 --- a/drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c +++ b/drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c @@ -132,39 +132,68 @@ int alloc_enum_data(void) * @enumeration_obj: ACPI object with enumeration data * @instance_id: The instance to enumerate * @attr_name_kobj: The parent kernel object + * @enum_property_count: Total properties count under enumeration type */ int populate_enum_data(union acpi_object *enumeration_obj, int instance_id, - struct kobject *attr_name_kobj) + struct kobject *attr_name_kobj, u32 enum_property_count) { int i, next_obj, value_modifier_count, possible_values_count; wmi_priv.enumeration_data[instance_id].attr_name_kobj = attr_name_kobj; + if (check_property_type(enumeration, ATTR_NAME, ACPI_TYPE_STRING)) + return -EINVAL; strlcpy_attr(wmi_priv.enumeration_data[instance_id].attribute_name, enumeration_obj[ATTR_NAME].string.pointer); + if (check_property_type(enumeration, DISPL_NAME_LANG_CODE, ACPI_TYPE_STRING)) + return -EINVAL; strlcpy_attr(wmi_priv.enumeration_data[instance_id].display_name_language_code, enumeration_obj[DISPL_NAME_LANG_CODE].string.pointer); + if (check_property_type(enumeration, DISPLAY_NAME, ACPI_TYPE_STRING)) + return -EINVAL; strlcpy_attr(wmi_priv.enumeration_data[instance_id].display_name, enumeration_obj[DISPLAY_NAME].string.pointer); + if (check_property_type(enumeration, DEFAULT_VAL, ACPI_TYPE_STRING)) + return -EINVAL; strlcpy_attr(wmi_priv.enumeration_data[instance_id].default_value, enumeration_obj[DEFAULT_VAL].string.pointer); + if (check_property_type(enumeration, MODIFIER, ACPI_TYPE_STRING)) + return -EINVAL; strlcpy_attr(wmi_priv.enumeration_data[instance_id].dell_modifier, enumeration_obj[MODIFIER].string.pointer); next_obj = MODIFIER + 1; - value_modifier_count = (uintptr_t)enumeration_obj[next_obj].string.pointer; + if (next_obj >= enum_property_count) + return -EINVAL; + + if (check_property_type(enumeration, next_obj, ACPI_TYPE_INTEGER)) + return -EINVAL; + value_modifier_count = (uintptr_t)enumeration_obj[next_obj++].string.pointer; for (i = 0; i < value_modifier_count; i++) { + if (next_obj >= enum_property_count) + return -EINVAL; + if (check_property_type(enumeration, next_obj, ACPI_TYPE_STRING)) + return -EINVAL; strcat(wmi_priv.enumeration_data[instance_id].dell_value_modifier, - enumeration_obj[++next_obj].string.pointer); + enumeration_obj[next_obj++].string.pointer); strcat(wmi_priv.enumeration_data[instance_id].dell_value_modifier, ";"); } - possible_values_count = (uintptr_t) enumeration_obj[++next_obj].string.pointer; + if (next_obj >= enum_property_count) + return -EINVAL; + + if (check_property_type(enumeration, next_obj, ACPI_TYPE_INTEGER)) + return -EINVAL; + possible_values_count = (uintptr_t) enumeration_obj[next_obj++].string.pointer; for (i = 0; i < possible_values_count; i++) { + if (next_obj >= enum_property_count) + return -EINVAL; + if (check_property_type(enumeration, next_obj, ACPI_TYPE_STRING)) + return -EINVAL; strcat(wmi_priv.enumeration_data[instance_id].possible_values, - enumeration_obj[++next_obj].string.pointer); + enumeration_obj[next_obj++].string.pointer); strcat(wmi_priv.enumeration_data[instance_id].possible_values, ";"); } |