From 0433d8f0180a8dcc1c6faf9948193d96e174e574 Mon Sep 17 00:00:00 2001
From: lgao4 <lgao4@6f19259b-4bc3-4df7-8a09-765794883524>
Date: Mon, 26 Jul 2010 16:20:34 +0000
Subject: Make sure gBS FreePool() is used to free the buffer always allocated
 by gBS AllocatePool() service.

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@10695 6f19259b-4bc3-4df7-8a09-765794883524
---
 MdePkg/Library/DxeServicesLib/DxeServicesLib.c     | 38 ++++++++++++++++++++--
 .../PciSegmentLib.c                                |  6 +++-
 2 files changed, 40 insertions(+), 4 deletions(-)

(limited to 'MdePkg')

diff --git a/MdePkg/Library/DxeServicesLib/DxeServicesLib.c b/MdePkg/Library/DxeServicesLib/DxeServicesLib.c
index d8e6b5c..9cf845d 100644
--- a/MdePkg/Library/DxeServicesLib/DxeServicesLib.c
+++ b/MdePkg/Library/DxeServicesLib/DxeServicesLib.c
@@ -122,6 +122,7 @@ InternalGetSectionFromFv (
   EFI_STATUS                    Status;
   EFI_FIRMWARE_VOLUME2_PROTOCOL *Fv;
   UINT32                        AuthenticationStatus;
+  VOID*                         TempBuffer;
 
   ASSERT (NameGuid != NULL);
   ASSERT (Buffer != NULL);
@@ -170,6 +171,17 @@ InternalGetSectionFromFv (
                     );
   }
 
+  if (!EFI_ERROR (Status)) {
+    //
+    // The found buffer by FV protocol is allocated by gBS AllocatePool() service. 
+    // Copy the found buffer to the allocated buffer by AllocatePool().
+    // So, the returned buffer can be freed by FreePool().
+    //
+    TempBuffer = AllocateCopyPool (*Size, *Buffer);
+    gBS->FreePool (*Buffer);
+    *Buffer = TempBuffer;
+  }
+
   return Status;
 }
 
@@ -312,7 +324,11 @@ GetSectionFromAnyFvByFileType  (
 
 Done:
   if (HandleBuffer != NULL) {  
-    FreePool(HandleBuffer);
+    //
+    // HandleBuffer is allocated by gBS AllocatePool() service. 
+    // So, gBS FreePool() service is used to free HandleBuffer.
+    //
+    gBS->FreePool (HandleBuffer);
   }
 
   return Status;
@@ -435,8 +451,12 @@ GetSectionFromAnyFv  (
 
 Done:
   
-  if (HandleBuffer != NULL) {  
-    FreePool(HandleBuffer);
+  if (HandleBuffer != NULL) {
+    //
+    // HandleBuffer is allocated by gBS AllocatePool() service. 
+    // So, gBS FreePool() service is used to free HandleBuffer.
+    //
+    gBS->FreePool (HandleBuffer);
   }
   return Status;
   
@@ -615,6 +635,7 @@ GetFileBufferByFilePath (
   EFI_FIRMWARE_VOLUME2_PROTOCOL     *FwVol;
   EFI_SECTION_TYPE                  SectionType;
   UINT8                             *ImageBuffer;
+  UINT8                             *TempBuffer;
   UINTN                             ImageBufferSize;
   EFI_FV_FILETYPE                   Type;
   EFI_FV_FILE_ATTRIBUTES            Attrib;
@@ -642,6 +663,7 @@ GetFileBufferByFilePath (
   FileInfo            = NULL;
   FileHandle          = NULL;
   ImageBuffer         = NULL;
+  TempBuffer          = NULL;
   ImageBufferSize     = 0;
   *AuthenticationStatus = 0;
   
@@ -702,6 +724,16 @@ GetFileBufferByFilePath (
                             AuthenticationStatus
                             );
         }
+        if (!EFI_ERROR (Status)) {
+          //
+          // The found buffer by FV protocol is allocated by gBS AllocatePool() service. 
+          // Copy the found buffer to the allocated buffer by AllocatePool().
+          // Then, this returned buffer can be freed by FreePool().
+          //
+          TempBuffer = AllocateCopyPool (ImageBufferSize, ImageBuffer);
+          gBS->FreePool (ImageBuffer);
+          ImageBuffer = TempBuffer;
+        }
       }
     }
     goto Finish;
diff --git a/MdePkg/Library/UefiPciSegmentLibPciRootBridgeIo/PciSegmentLib.c b/MdePkg/Library/UefiPciSegmentLibPciRootBridgeIo/PciSegmentLib.c
index ccd9df3..d6527ef 100644
--- a/MdePkg/Library/UefiPciSegmentLibPciRootBridgeIo/PciSegmentLib.c
+++ b/MdePkg/Library/UefiPciSegmentLibPciRootBridgeIo/PciSegmentLib.c
@@ -96,7 +96,11 @@ PciSegmentLibConstructor (
     ASSERT (Descriptors->Desc != ACPI_END_TAG_DESCRIPTOR);
   }
 
-  FreePool(HandleBuffer);
+  //
+  // HandleBuffer is allocated by gBS AllocatePool() service. 
+  // So, gBS FreePool() service is used to free HandleBuffer.
+  //
+  gBS->FreePool (HandleBuffer);
 
   return EFI_SUCCESS;
 }
-- 
cgit v1.1