From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
To: xen-devel <xen-devel@lists.xen.org>
Cc: Feng Jin <joe.jin@oracle.com>,
Ian Jackson <Ian.Jackson@eu.citrix.com>,
Ian Campbell <Ian.Campbell@citrix.com>,
Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Subject: [PATCH v2] Minor change to avoid potental overflow accessing pci option roms
Date: Tue, 20 Aug 2013 14:38:19 +0800 [thread overview]
Message-ID: <52130EDB.2060602@oracle.com> (raw)
When scan pci option roms space, there is possibility to access beyond
OPTIONROM_PHYSICAL_END for 2K.
This patch makes the code robust though there are other checks such as
0x55AA signature.
Bug was found by code inspection.
v2: Add description per Konrad's suggestion, thanks.
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
---
tools/firmware/rombios/rombios.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/firmware/rombios/rombios.c b/tools/firmware/rombios/rombios.c
index 057aced..f5ac33e 100644
--- a/tools/firmware/rombios/rombios.c
+++ b/tools/firmware/rombios/rombios.c
@@ -10648,7 +10648,7 @@ rom_scan_increment:
add cx, ax
pop ax ;; Restore AX
cmp cx, ax
- jbe rom_scan_loop
+ jb rom_scan_loop
xor ax, ax ;; Restore DS back to 0000:
mov ds, ax
@@ -11022,7 +11022,7 @@ post_default_ints:
call post_init_pic
mov cx, #0xc000 ;; init vga bios
- mov ax, #0xc780
+ mov ax, #0xc800
call rom_scan
call _print_bios_banner
--
1.7.3
reply other threads:[~2013-08-20 6:38 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=52130EDB.2060602@oracle.com \
--to=zhenzhong.duan@oracle.com \
--cc=Ian.Campbell@citrix.com \
--cc=Ian.Jackson@eu.citrix.com \
--cc=joe.jin@oracle.com \
--cc=stefano.stabellini@eu.citrix.com \
--cc=xen-devel@lists.xen.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).