1 files changed, 40 insertions, 13 deletions

diff --git a/sys/contrib/dev/acpica/exconfig.c b/sys/contrib/dev/acpica/exconfig.c
index 99c93fcc0a4e..e3ed1087431c 100644
--- a/sys/contrib/dev/acpica/exconfig.c
+++ b/sys/contrib/dev/acpica/exconfig.c
@@ -1,7 +1,7 @@
 /******************************************************************************
  *
  * Module Name: exconfig - Namespace reconfiguration (Load/Unload opcodes)
- *              $Revision: 75 $
+ *              $Revision: 77 $
  *
  *****************************************************************************/
 
@@ -123,6 +123,7 @@
 #include "acnamesp.h"
 #include "acevents.h"
 #include "actables.h"
+#include "acdispat.h"
 
 
 #define _COMPONENT          ACPI_EXECUTER
@@ -375,7 +376,7 @@ AcpiExLoadOp (
     ACPI_OPERAND_OBJECT     *DdbHandle;
     ACPI_OPERAND_OBJECT     *BufferDesc = NULL;
     ACPI_TABLE_HEADER       *TablePtr = NULL;
-    UINT8                   *TableDataPtr;
+    ACPI_PHYSICAL_ADDRESS   Address;
     ACPI_TABLE_HEADER       TableHeader;
     UINT32                  i;
 
@@ -391,13 +392,30 @@ AcpiExLoadOp (
         ACPI_DEBUG_PRINT ((ACPI_DB_EXEC, "Load from Region %p %s\n",
             ObjDesc, AcpiUtGetObjectTypeName (ObjDesc)));
 
-        /* Get the table header */
+        /*
+         * If the Region Address and Length have not been previously evaluated,
+         * evaluate them now and save the results.
+         */
+        if (!(ObjDesc->Common.Flags & AOPOBJ_DATA_VALID))
+        {
+            Status = AcpiDsGetRegionArguments (ObjDesc);
+            if (ACPI_FAILURE (Status))
+            {
+                return_ACPI_STATUS (Status);
+            }
+        }
+
+        /* Get the base physical address of the region */
+
+        Address = ObjDesc->Region.Address;
+
+        /* Get the table length from the table header */
 
         TableHeader.Length = 0;
-        for (i = 0; i < sizeof (ACPI_TABLE_HEADER); i++)
+        for (i = 0; i < 8; i++)
         {
             Status = AcpiEvAddressSpaceDispatch (ObjDesc, ACPI_READ,
-                                (ACPI_PHYSICAL_ADDRESS) i, 8,
+                                (ACPI_PHYSICAL_ADDRESS) i + Address, 8,
                                 ((UINT8 *) &TableHeader) + i);
             if (ACPI_FAILURE (Status))
             {
@@ -405,6 +423,13 @@ AcpiExLoadOp (
             }
         }
 
+        /* Sanity check the table length */
+
+        if (TableHeader.Length < sizeof (ACPI_TABLE_HEADER))
+        {
+            return_ACPI_STATUS (AE_BAD_HEADER);
+        }
+
         /* Allocate a buffer for the entire table */
 
         TablePtr = ACPI_MEM_ALLOCATE (TableHeader.Length);
@@ -413,18 +438,13 @@ AcpiExLoadOp (
             return_ACPI_STATUS (AE_NO_MEMORY);
         }
 
-        /* Copy the header to the buffer */
-
-        ACPI_MEMCPY (TablePtr, &TableHeader, sizeof (ACPI_TABLE_HEADER));
-        TableDataPtr = ACPI_PTR_ADD (UINT8, TablePtr, sizeof (ACPI_TABLE_HEADER));
-
-        /* Get the table from the op region */
+        /* Get the entire table from the op region */
 
         for (i = 0; i < TableHeader.Length; i++)
         {
             Status = AcpiEvAddressSpaceDispatch (ObjDesc, ACPI_READ,
-                                (ACPI_PHYSICAL_ADDRESS) i, 8,
-                                ((UINT8 *) TableDataPtr + i));
+                                (ACPI_PHYSICAL_ADDRESS) i + Address, 8,
+                                ((UINT8 *) TablePtr + i));
             if (ACPI_FAILURE (Status))
             {
                 goto Cleanup;
@@ -452,6 +472,13 @@ AcpiExLoadOp (
         }
 
         TablePtr = ACPI_CAST_PTR (ACPI_TABLE_HEADER, BufferDesc->Buffer.Pointer);
+
+         /* Sanity check the table length */
+
+        if (TablePtr->Length < sizeof (ACPI_TABLE_HEADER))
+        {
+            return_ACPI_STATUS (AE_BAD_HEADER);
+        }
         break;