From: Robert Millan <rmh@aybabtu.com>
To: grub-devel@gnu.org
Subject: Re: [PATCH] fix memory corruption issues in grub_vbe_bios_getset_dac_palette()
Date: Sat, 12 Sep 2009 15:06:14 +0200 [thread overview]
Message-ID: <20090912130614.GA11468@thorin> (raw)
In-Reply-To: <20090910194816.GA19509@thorin>
Committed. Btw, revision of the existing code in this function still
welcome (not all memory corruption bugs associated with it are fixed).
On Thu, Sep 10, 2009 at 09:48:16PM +0200, Robert Millan wrote:
>
> These were spotted by Colin Watson. Unfortunately, users report that it
> doesn't fix the problem for them. But the fix almost certainly looks good,
> so I'm inclined to commit it.
>
> I'd appreciate if more people can review this code (my proposed changes and
> the function as a whole). I can't see any other vector that could introduce
> corruption, other than the VBE interrupt routine itself.
>
> --
> Robert Millan
>
> The DRM opt-in fallacy: "Your data belongs to us. We will decide when (and
> how) you may access your data; but nobody's threatening your freedom: we
> still allow you to remove your data and not access it at all."
> 2009-09-10 Robert Millan <rmh.grub@aybabtu.com>
>
> Fix memory corruption issue (spotted by Colin Watson).
>
> * kern/i386/pc/startup.S (grub_vbe_bios_getset_dac_palette): Fix bug
> causing returned size to be stored in an incorrect memory location.
> Fix use of uninitialized value when storing the returned size.
>
> Index: kern/i386/pc/startup.S
> ===================================================================
> --- kern/i386/pc/startup.S (revision 2583)
> +++ kern/i386/pc/startup.S (working copy)
> @@ -1761,18 +1761,18 @@ FUNCTION(grub_vbe_bios_getset_dac_palett
> movw $0x4f08, %ax
> int $0x10
>
> - movw %ax, %dx /* real_to_prot destroys %eax. */
> + movw %ax, %cx /* real_to_prot destroys %eax. */
>
> DATA32 call real_to_prot
> .code32
>
> /* Move result back to *dac_mask_size. */
> + xorl %eax, %eax
> movb %bh, %al
> movl %eax, (%edx)
>
> /* Return value in %eax. */
> - xorl %eax, %eax
> - movw %dx, %ax
> + movw %cx, %ax
>
> popl %ebx
> popl %ebp
> _______________________________________________
> Grub-devel mailing list
> Grub-devel@gnu.org
> http://lists.gnu.org/mailman/listinfo/grub-devel
--
Robert Millan
The DRM opt-in fallacy: "Your data belongs to us. We will decide when (and
how) you may access your data; but nobody's threatening your freedom: we
still allow you to remove your data and not access it at all."
prev parent reply other threads:[~2009-09-12 13:06 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-09-10 19:48 [PATCH] fix memory corruption issues in grub_vbe_bios_getset_dac_palette() Robert Millan
2009-09-12 13:06 ` Robert Millan [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20090912130614.GA11468@thorin \
--to=rmh@aybabtu.com \
--cc=grub-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.