Fix a potential memory free failure bug in AtaAtapiPassThru

Signed-off-by: erictian
Reviewed-by: rsun3

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@11932 6f19259b-4bc3-4df7-8a09-765794883524

1 files changed, 9 insertions, 7 deletions

diff --git a/MdeModulePkg/Bus/Ata/AtaAtapiPassThru/IdeMode.c b/MdeModulePkg/Bus/Ata/AtaAtapiPassThru/IdeMode.c
index af1e5aeb52..1eb8c0eaae 100644
--- a/MdeModulePkg/Bus/Ata/AtaAtapiPassThru/IdeMode.c
+++ b/MdeModulePkg/Bus/Ata/AtaAtapiPassThru/IdeMode.c
@@ -1470,6 +1470,7 @@ AtaUdmaInOut (
   EFI_PHYSICAL_ADDRESS          PrdTableMapAddr;

   VOID                          *PrdTableMap;

   EFI_ATA_DMA_PRD               *PrdBaseAddr;

+  EFI_ATA_DMA_PRD               *TempPrdBaseAddr;

   UINTN                         PrdTableNum;

 

   UINT8                         RegisterValue;

@@ -1618,21 +1619,22 @@ AtaUdmaInOut (
     //

     // Fill the PRD table with appropriate bus master address of data buffer and data length.

     //

-    ByteRemaining = ByteCount;

+    ByteRemaining   = ByteCount;

+    TempPrdBaseAddr = PrdBaseAddr;

     while (ByteRemaining != 0) {

       if (ByteRemaining <= 0x10000) {

-        PrdBaseAddr->RegionBaseAddr = (UINT32) ((UINTN) BufferMapAddress);

-        PrdBaseAddr->ByteCount      = (UINT16) ByteRemaining;

-        PrdBaseAddr->EndOfTable     = 0x8000;

+        TempPrdBaseAddr->RegionBaseAddr = (UINT32) ((UINTN) BufferMapAddress);

+        TempPrdBaseAddr->ByteCount      = (UINT16) ByteRemaining;

+        TempPrdBaseAddr->EndOfTable     = 0x8000;

         break;

       }

 

-      PrdBaseAddr->RegionBaseAddr = (UINT32) ((UINTN) BufferMapAddress);

-      PrdBaseAddr->ByteCount      = (UINT16) 0x0;

+      TempPrdBaseAddr->RegionBaseAddr = (UINT32) ((UINTN) BufferMapAddress);

+      TempPrdBaseAddr->ByteCount      = (UINT16) 0x0;

 

       ByteRemaining    -= 0x10000;

       BufferMapAddress += 0x10000;

-      PrdBaseAddr++;

+      TempPrdBaseAddr++;

     }

 

     //