if ((index < operand[0]->string.length) && (length > 0)) { /* Truncate request if larger than the actual String/Buffer */ 
if (index >= operand[0]->string.length) { length = 0; } 
acpi_ex_opcode_3A_1T_1R (	struct acpi_walk_state          *walk_state){	union acpi_operand_object       **operand = &walk_state->operands[0];	union acpi_operand_object       *return_desc = NULL;	char                            *buffer;	acpi_status                     status = AE_OK;	acpi_integer                    index;	acpi_size                       length;	ACPI_FUNCTION_TRACE_STR ("ex_opcode_3A_1T_1R",		acpi_ps_get_opcode_name (walk_state->opcode));	switch (walk_state->opcode) {	case AML_MID_OP:    /* Mid (Source[0], Index[1], Length[2], Result[3]) */		/*		 * Create the return object.  The Source operand is guaranteed to be		 * either a String or a Buffer, so just use its type.		 */		return_desc = acpi_ut_create_internal_object (				  ACPI_GET_OBJECT_TYPE (operand[0]));		if (!return_desc) {			status = AE_NO_MEMORY;			goto cleanup;		}		/* Get the Integer values from the objects */		index = operand[1]->integer.value;		length = (acpi_size) operand[2]->integer.value;		/*		 * If the index is beyond the length of the String/Buffer, or if the		 * requested length is zero, return a zero-length String/Buffer		 */		if ((index < operand[0]->string.length) &&			(length > 0)) {			/* Truncate request if larger than the actual String/Buffer */			if ((index + length) >				operand[0]->string.length) {				length = (acpi_size) operand[0]->string.length -						 (acpi_size) index;			}			/* Allocate a new buffer for the String/Buffer */			buffer = ACPI_MEM_CALLOCATE ((acpi_size) length + 1);			if (!buffer) {				status = AE_NO_MEMORY;				goto cleanup;			}			/* Copy the portion requested */			ACPI_MEMCPY (buffer, operand[0]->string.pointer + index,					  length);			/* Set the length of the new String/Buffer */			return_desc->string.pointer = buffer;			return_desc->string.length = (u32) length;		}		/* Mark buffer initialized */		return_desc->buffer.flags |= AOPOBJ_DATA_VALID;		break;	default:		ACPI_REPORT_ERROR (("acpi_ex_opcode_3A_0T_0R: Unknown opcode %X\n",				walk_state->opcode));		status = AE_AML_BAD_OPCODE;		goto cleanup;	}	/* Store the result in the target */	status = acpi_ex_store (return_desc, operand[3], walk_state);cleanup:	/* Delete return object on error */	if (ACPI_FAILURE (status)) {		acpi_ut_remove_reference (return_desc);	}	/* Set the return object and exit */	if (!walk_state->result_obj) {		walk_state->result_obj = return_desc;	}	return_ACPI_STATUS (status);}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/73459f73e5d1602c59ebec114fc45185521353c1/exoparg3.c/buggy/drivers/acpi/executer/exoparg3.c