1 files changed, 46 insertions, 17 deletions

diff --git a/drivers/acpi/executer/exoparg3.c b/drivers/acpi/executer/exoparg3.c
index 23b068adbf5..197890f443b 100644
--- a/drivers/acpi/executer/exoparg3.c
+++ b/drivers/acpi/executer/exoparg3.c
@@ -160,7 +160,7 @@ acpi_ex_opcode_3A_1T_1R (
 {
         union acpi_operand_object       **operand = &walk_state->operands[0];
         union acpi_operand_object       *return_desc = NULL;
-        char                            *buffer;
+        char                            *buffer = NULL;
         acpi_status                     status = AE_OK;
         acpi_integer                    index;
         acpi_size                       length;
@@ -193,34 +193,63 @@ acpi_ex_opcode_3A_1T_1R (
                  * If the index is beyond the length of the String/Buffer, or if the
                  * requested length is zero, return a zero-length String/Buffer
                  */
-                if ((index < operand[0]->string.length) &&
-                        (length > 0)) {
-                        /* Truncate request if larger than the actual String/Buffer */
-
-                        if ((index + length) >
-                                operand[0]->string.length) {
-                                length = (acpi_size) operand[0]->string.length -
-                                                 (acpi_size) index;
-                        }
+                if (index >= operand[0]->string.length) {
+                        length = 0;
+                }
+
+                /* Truncate request if larger than the actual String/Buffer */
+
+                else if ((index + length) > operand[0]->string.length) {
+                        length = (acpi_size) operand[0]->string.length -
+                                         (acpi_size) index;
+                }
 
-                        /* Allocate a new buffer for the String/Buffer */
+                /* Strings always have a sub-pointer, not so for buffers */
+
+                switch (ACPI_GET_OBJECT_TYPE (operand[0])) {
+                case ACPI_TYPE_STRING:
+
+                        /* Always allocate a new buffer for the String */
 
                         buffer = ACPI_MEM_CALLOCATE ((acpi_size) length + 1);
                         if (!buffer) {
                                 status = AE_NO_MEMORY;
                                 goto cleanup;
                         }
+                        break;
+
+                case ACPI_TYPE_BUFFER:
+
+                        /* If the requested length is zero, don't allocate a buffer */
+
+                        if (length > 0) {
+                                /* Allocate a new buffer for the Buffer */
+
+                                buffer = ACPI_MEM_CALLOCATE (length);
+                                if (!buffer) {
+                                        status = AE_NO_MEMORY;
+                                        goto cleanup;
+                                }
+                        }
+                        break;
 
+                default:                        /* Should not happen */
+
+                        status = AE_AML_OPERAND_TYPE;
+                        goto cleanup;
+                }
+
+                if (length > 0) {
                         /* Copy the portion requested */
 
                         ACPI_MEMCPY (buffer, operand[0]->string.pointer + index,
                                           length);
+                }
 
-                        /* Set the length of the new String/Buffer */
+                /* Set the length of the new String/Buffer */
 
-                        return_desc->string.pointer = buffer;
-                        return_desc->string.length = (u32) length;
-                }
+                return_desc->string.pointer = buffer;
+                return_desc->string.length = (u32) length;
 
                 /* Mark buffer initialized */
 
@@ -244,13 +273,13 @@ cleanup:
 
         /* Delete return object on error */
 
-        if (ACPI_FAILURE (status)) {
+        if (ACPI_FAILURE (status) || walk_state->result_obj) {
                 acpi_ut_remove_reference (return_desc);
         }
 
         /* Set the return object and exit */
 
-        if (!walk_state->result_obj) {
+        else {
                 walk_state->result_obj = return_desc;
         }
         return_ACPI_STATUS (status);