EmbeddedPkg/NonCoherentDmaLib: avoid dereferencing bogus buffer address

The bounce buffering code in NonCoherentDmaLib copies data into the
bounce buffer using CopyMem(), but passes Map->HostAddress as the
source of the copy before it has been assigned its correct value.

Signed-off-by: Ard Biesheuvel <ard.biesheuvel@arm.com>
Reviewed-by: Leif Lindholm <leif@nuviainc.com>
Reviewed-by: Andrei Warkentin <awarkentin@vmware.com>

diff --git a/EmbeddedPkg/Library/NonCoherentDmaLib/NonCoherentDmaLib.c b/EmbeddedPkg/Library/NonCoherentDmaLib/NonCoherentDmaLib.c
index 1153457654350c4fdf33650aa81887a23ee0f4ee..9c8ef5bfb533b1d4c480b4c4cfd3fe50a27bd936 100644 (file)
--- a/EmbeddedPkg/Library/NonCoherentDmaLib/NonCoherentDmaLib.c
+++ b/EmbeddedPkg/Library/NonCoherentDmaLib/NonCoherentDmaLib.c
@@ -225,8 +225,7 @@ DmaMap (
     }\r
 \r
     if (Map->Operation == MapOperationBusMasterRead) {\r
-      CopyMem (Map->BufferAddress, (VOID *)(UINTN)Map->HostAddress,\r
-        *NumberOfBytes);\r
+      CopyMem (Map->BufferAddress, (VOID *)(UINTN)HostAddress, *NumberOfBytes);\r
     }\r
     mCpu->FlushDataCache (mCpu, (UINTN)Map->BufferAddress, AllocSize,\r
             EfiCpuFlushTypeWriteBack);\r