ACPICA: Fix condition check in acpi_ps_parse_loop()

Fix condition check for AML_ELSE_OP in acpi_ps_parse_loop() to prevent
out-of-bounds access.

Link: https://github.com/acpica/acpica/commit/3b537b92336e
Signed-off-by: ikaros <void0red@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/1959692.tdWV9SEqCh@rafael.j.wysocki

diff --git a/drivers/acpi/acpica/psloop.c b/drivers/acpi/acpica/psloop.c
index c989cadf271ce075218f9cc2590e3e01b1e76483..35111ff2526b1f9e71e10eab08e1cc1697d67924 100644 (file)
--- a/drivers/acpi/acpica/psloop.c
+++ b/drivers/acpi/acpica/psloop.c
@@ -425,7 +425,10 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
 
                                        ACPI_ERROR((AE_INFO,
                                                    "Skipping While/If block"));
-                                       if (*walk_state->aml == AML_ELSE_OP) {
+                                       if ((walk_state->aml <
+                                            parser_state->aml_end)
+                                           && (*walk_state->aml ==
+                                               AML_ELSE_OP)) {
                                                ACPI_ERROR((AE_INFO,
                                                            "Skipping Else block"));
                                                walk_state->parser_state.aml =