From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with archive (Exim 4.43) id 1MmSJ7-0002LL-HB for mharc-grub-devel@gnu.org; Sat, 12 Sep 2009 09:06:25 -0400 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1MmSJ5-0002L5-8S for grub-devel@gnu.org; Sat, 12 Sep 2009 09:06:23 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1MmSJ0-0002KZ-OB for grub-devel@gnu.org; Sat, 12 Sep 2009 09:06:22 -0400 Received: from [199.232.76.173] (port=45309 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1MmSJ0-0002KW-JG for grub-devel@gnu.org; Sat, 12 Sep 2009 09:06:18 -0400 Received: from xvm-190-8.ghst.net ([217.70.190.8]:35956 helo=aybabtu.com) by monty-python.gnu.org with esmtps (TLS-1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1MmSJ0-0002CT-3W for grub-devel@gnu.org; Sat, 12 Sep 2009 09:06:18 -0400 Received: from [192.168.10.10] (helo=thorin) by aybabtu.com with esmtp (Exim 4.69) (envelope-from ) id 1MmSIx-0005Np-PD for grub-devel@gnu.org; Sat, 12 Sep 2009 15:06:15 +0200 Received: from rmh by thorin with local (Exim 4.69) (envelope-from ) id 1MmSIw-00030n-UC for grub-devel@gnu.org; Sat, 12 Sep 2009 15:06:14 +0200 Date: Sat, 12 Sep 2009 15:06:14 +0200 From: Robert Millan To: grub-devel@gnu.org Message-ID: <20090912130614.GA11468@thorin> References: <20090910194816.GA19509@thorin> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20090910194816.GA19509@thorin> Organization: free as in freedom X-Message-Flag: Worried about Outlook viruses? Switch to Thunderbird! www.mozilla.com/thunderbird X-Debbugs-No-Ack: true User-Agent: Mutt/1.5.18 (2008-05-17) X-detected-operating-system: by monty-python.gnu.org: GNU/Linux 2.6 (newer, 3) Subject: Re: [PATCH] fix memory corruption issues in grub_vbe_bios_getset_dac_palette() X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: The development of GRUB 2 List-Id: The development of GRUB 2 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 12 Sep 2009 13:06:23 -0000 Committed. Btw, revision of the existing code in this function still welcome (not all memory corruption bugs associated with it are fixed). On Thu, Sep 10, 2009 at 09:48:16PM +0200, Robert Millan wrote: > > These were spotted by Colin Watson. Unfortunately, users report that it > doesn't fix the problem for them. But the fix almost certainly looks good, > so I'm inclined to commit it. > > I'd appreciate if more people can review this code (my proposed changes and > the function as a whole). I can't see any other vector that could introduce > corruption, other than the VBE interrupt routine itself. > > -- > Robert Millan > > The DRM opt-in fallacy: "Your data belongs to us. We will decide when (and > how) you may access your data; but nobody's threatening your freedom: we > still allow you to remove your data and not access it at all." > 2009-09-10 Robert Millan > > Fix memory corruption issue (spotted by Colin Watson). > > * kern/i386/pc/startup.S (grub_vbe_bios_getset_dac_palette): Fix bug > causing returned size to be stored in an incorrect memory location. > Fix use of uninitialized value when storing the returned size. > > Index: kern/i386/pc/startup.S > =================================================================== > --- kern/i386/pc/startup.S (revision 2583) > +++ kern/i386/pc/startup.S (working copy) > @@ -1761,18 +1761,18 @@ FUNCTION(grub_vbe_bios_getset_dac_palett > movw $0x4f08, %ax > int $0x10 > > - movw %ax, %dx /* real_to_prot destroys %eax. */ > + movw %ax, %cx /* real_to_prot destroys %eax. */ > > DATA32 call real_to_prot > .code32 > > /* Move result back to *dac_mask_size. */ > + xorl %eax, %eax > movb %bh, %al > movl %eax, (%edx) > > /* Return value in %eax. */ > - xorl %eax, %eax > - movw %dx, %ax > + movw %cx, %ax > > popl %ebx > popl %ebp > _______________________________________________ > Grub-devel mailing list > Grub-devel@gnu.org > http://lists.gnu.org/mailman/listinfo/grub-devel -- Robert Millan The DRM opt-in fallacy: "Your data belongs to us. We will decide when (and how) you may access your data; but nobody's threatening your freedom: we still allow you to remove your data and not access it at all."