From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with archive (Exim 4.43) id 1Mlpd4-0006X6-Nm for mharc-grub-devel@gnu.org; Thu, 10 Sep 2009 15:48:26 -0400 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1Mlpd2-0006Ww-H1 for grub-devel@gnu.org; Thu, 10 Sep 2009 15:48:24 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1Mlpcy-0006WZ-0n for grub-devel@gnu.org; Thu, 10 Sep 2009 15:48:24 -0400 Received: from [199.232.76.173] (port=54427 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Mlpcx-0006WW-SG for grub-devel@gnu.org; Thu, 10 Sep 2009 15:48:19 -0400 Received: from xvm-190-8.ghst.net ([217.70.190.8]:52695 helo=aybabtu.com) by monty-python.gnu.org with esmtps (TLS-1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1Mlpcx-0007Ju-FG for grub-devel@gnu.org; Thu, 10 Sep 2009 15:48:19 -0400 Received: from [192.168.10.10] (helo=thorin) by aybabtu.com with esmtp (Exim 4.69) (envelope-from ) id 1Mlpcv-0007MV-8K for grub-devel@gnu.org; Thu, 10 Sep 2009 21:48:17 +0200 Received: from rmh by thorin with local (Exim 4.69) (envelope-from ) id 1Mlpcu-00054r-Hw for grub-devel@gnu.org; Thu, 10 Sep 2009 21:48:16 +0200 Date: Thu, 10 Sep 2009 21:48:16 +0200 From: Robert Millan To: grub-devel@gnu.org Message-ID: <20090910194816.GA19509@thorin> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="n8g4imXOkfNTN/H1" Content-Disposition: inline Organization: free as in freedom X-Message-Flag: Worried about Outlook viruses? Switch to Thunderbird! www.mozilla.com/thunderbird X-Debbugs-No-Ack: true User-Agent: Mutt/1.5.18 (2008-05-17) X-detected-operating-system: by monty-python.gnu.org: GNU/Linux 2.6 (newer, 3) Subject: [PATCH] fix memory corruption issues in grub_vbe_bios_getset_dac_palette() X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: The development of GRUB 2 List-Id: The development of GRUB 2 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Sep 2009 19:48:25 -0000 --n8g4imXOkfNTN/H1 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline These were spotted by Colin Watson. Unfortunately, users report that it doesn't fix the problem for them. But the fix almost certainly looks good, so I'm inclined to commit it. I'd appreciate if more people can review this code (my proposed changes and the function as a whole). I can't see any other vector that could introduce corruption, other than the VBE interrupt routine itself. -- Robert Millan The DRM opt-in fallacy: "Your data belongs to us. We will decide when (and how) you may access your data; but nobody's threatening your freedom: we still allow you to remove your data and not access it at all." --n8g4imXOkfNTN/H1 Content-Type: text/x-diff; charset=us-ascii Content-Disposition: attachment; filename="grub_vbe_bios_getset_dac_palette.diff" 2009-09-10 Robert Millan Fix memory corruption issue (spotted by Colin Watson). * kern/i386/pc/startup.S (grub_vbe_bios_getset_dac_palette): Fix bug causing returned size to be stored in an incorrect memory location. Fix use of uninitialized value when storing the returned size. Index: kern/i386/pc/startup.S =================================================================== --- kern/i386/pc/startup.S (revision 2583) +++ kern/i386/pc/startup.S (working copy) @@ -1761,18 +1761,18 @@ FUNCTION(grub_vbe_bios_getset_dac_palett movw $0x4f08, %ax int $0x10 - movw %ax, %dx /* real_to_prot destroys %eax. */ + movw %ax, %cx /* real_to_prot destroys %eax. */ DATA32 call real_to_prot .code32 /* Move result back to *dac_mask_size. */ + xorl %eax, %eax movb %bh, %al movl %eax, (%edx) /* Return value in %eax. */ - xorl %eax, %eax - movw %dx, %ax + movw %cx, %ax popl %ebx popl %ebp --n8g4imXOkfNTN/H1--