From 2525e2219837dfef6e0afebff70c9791c373fba3 Mon Sep 17 00:00:00 2001
From: erictian <erictian@6f19259b-4bc3-4df7-8a09-765794883524>
Date: Thu, 30 Jun 2011 03:32:00 +0000
Subject: Fix a potential memory free failure bug in AtaAtapiPassThru

Signed-off-by: erictian
Reviewed-by: rsun3

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@11932 6f19259b-4bc3-4df7-8a09-765794883524
---
 MdeModulePkg/Bus/Ata/AtaAtapiPassThru/IdeMode.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

(limited to 'MdeModulePkg/Bus')

diff --git a/MdeModulePkg/Bus/Ata/AtaAtapiPassThru/IdeMode.c b/MdeModulePkg/Bus/Ata/AtaAtapiPassThru/IdeMode.c
index af1e5aeb52..1eb8c0eaae 100644
--- a/MdeModulePkg/Bus/Ata/AtaAtapiPassThru/IdeMode.c
+++ b/MdeModulePkg/Bus/Ata/AtaAtapiPassThru/IdeMode.c
@@ -1470,6 +1470,7 @@ AtaUdmaInOut (
   EFI_PHYSICAL_ADDRESS          PrdTableMapAddr;
   VOID                          *PrdTableMap;
   EFI_ATA_DMA_PRD               *PrdBaseAddr;
+  EFI_ATA_DMA_PRD               *TempPrdBaseAddr;
   UINTN                         PrdTableNum;
 
   UINT8                         RegisterValue;
@@ -1618,21 +1619,22 @@ AtaUdmaInOut (
     //
     // Fill the PRD table with appropriate bus master address of data buffer and data length.
     //
-    ByteRemaining = ByteCount;
+    ByteRemaining   = ByteCount;
+    TempPrdBaseAddr = PrdBaseAddr;
     while (ByteRemaining != 0) {
       if (ByteRemaining <= 0x10000) {
-        PrdBaseAddr->RegionBaseAddr = (UINT32) ((UINTN) BufferMapAddress);
-        PrdBaseAddr->ByteCount      = (UINT16) ByteRemaining;
-        PrdBaseAddr->EndOfTable     = 0x8000;
+        TempPrdBaseAddr->RegionBaseAddr = (UINT32) ((UINTN) BufferMapAddress);
+        TempPrdBaseAddr->ByteCount      = (UINT16) ByteRemaining;
+        TempPrdBaseAddr->EndOfTable     = 0x8000;
         break;
       }
 
-      PrdBaseAddr->RegionBaseAddr = (UINT32) ((UINTN) BufferMapAddress);
-      PrdBaseAddr->ByteCount      = (UINT16) 0x0;
+      TempPrdBaseAddr->RegionBaseAddr = (UINT32) ((UINTN) BufferMapAddress);
+      TempPrdBaseAddr->ByteCount      = (UINT16) 0x0;
 
       ByteRemaining    -= 0x10000;
       BufferMapAddress += 0x10000;
-      PrdBaseAddr++;
+      TempPrdBaseAddr++;
     }
 
     //
-- 
cgit v1.2.3