[RFC PATCH 1/7] acpi: qemu_realloc() might return a different pointer

Eduard - Gabriel Munteanu
2010-03-30T08:20:26Z

We mustn't assume qemu_realloc() returns the same pointer in
acpi_table_add(). Therefore, 'p' might be invalid if it's relative to
the old value of acpi_tables.

Signed-off-by: Eduard - Gabriel Munteanu <eduard.munteanu@linux360.ro>
---
hw/acpi.c | 7 ++++---
1 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/acpi.c b/hw/acpi.c
index d293127..7c4e8d3 100644
--- a/hw/acpi.c
+++ b/hw/acpi.c
@@ -857,7 +857,7 @@ int acpi_table_add(const char *t)
char buf[1024], *p, *f;
struct acpi_table_header acpi_hdr;
unsigned long val;
- size_t off;
+ size_t newlen, off;

memset(&acpi_hdr, 0, sizeof(acpi_hdr));

@@ -938,9 +938,10 @@ int acpi_table_add(const char *t)
acpi_tables_len = sizeof(uint16_t);
acpi_tables = qemu_mallocz(acpi_tables_len);
}
+ newlen = acpi_tables_len + sizeof(uint16_t) + acpi_hdr.length;
+ acpi_tables = qemu_realloc(acpi_tables, newlen);
p = acpi_tables + acpi_tables_len;
- acpi_tables_len += sizeof(uint16_t) + acpi_hdr.length;
- acpi_tables = qemu_realloc(acpi_tables, acpi_tables_len);
+ acpi_tables_len = newlen;

acpi_hdr.length = cpu_to_le32(acpi_hdr.length);
*(uint16_t*)p = acpi_hdr.length;
--
1.6.4.4