summaryrefslogtreecommitdiff
path: root/payloads/libpayload
diff options
context:
space:
mode:
authorPatrick Georgi <patrick@georgi-clan.de>2015-02-22 16:49:10 +0100
committerPatrick Georgi <pgeorgi@google.com>2015-02-23 20:33:54 +0100
commita6c7ae70140450205cda6226e1905dfecb6cfabf (patch)
tree9f4e0dcb7ad1dd8a2963bbae64306854785935b5 /payloads/libpayload
parent477b4c539a5c05a0ccdf11b68fdff78b2ebe56cb (diff)
libpayload: avoid use-after-free in OHCI driver
Change-Id: I89294c22c57564262e53e36c5ae9ac6eb0ed934a Signed-off-by: Patrick Georgi <patrick@georgi-clan.de> Found-by: Coverity Scan Reviewed-on: http://review.coreboot.org/8510 Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net> Reviewed-by: Alexandru Gagniuc <mr.nuke.me@gmail.com> Tested-by: build bot (Jenkins)
Diffstat (limited to 'payloads/libpayload')
-rw-r--r--payloads/libpayload/drivers/usb/ohci.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/payloads/libpayload/drivers/usb/ohci.c b/payloads/libpayload/drivers/usb/ohci.c
index 3aa7810bd9..dffb8a49cd 100644
--- a/payloads/libpayload/drivers/usb/ohci.c
+++ b/payloads/libpayload/drivers/usb/ohci.c
@@ -854,12 +854,12 @@ ohci_process_done_queue(ohci_t *const ohci, const int spew_debug)
/* Free this TD, and */
free(td);
--intrq->remaining_tds;
- /* the interrupt queue if it has no more TDs. */
- if (!intrq->remaining_tds)
- free(intrq);
usb_debug("Freed TD from orphaned interrupt "
"queue, %d TDs remain.\n",
intrq->remaining_tds);
+ /* the interrupt queue if it has no more TDs. */
+ if (!intrq->remaining_tds)
+ free(intrq);
} else {
/* Save done TD to be processed. */
td->next = temp_tdq;