xen-devel.lists.xenproject.org archive mirror
 help / color / mirror / Atom feed
* [PATCH v2] Minor change to avoid potental overflow accessing pci option roms
@ 2013-08-20  6:38 Zhenzhong Duan
  0 siblings, 0 replies; only message in thread
From: Zhenzhong Duan @ 2013-08-20  6:38 UTC (permalink / raw)
  To: xen-devel; +Cc: Feng Jin, Ian Jackson, Ian Campbell, Stefano Stabellini

When scan pci option roms space, there is possibility to access beyond
OPTIONROM_PHYSICAL_END for 2K.

This patch makes the code robust though there are other checks such as
0x55AA signature.

Bug was found by code inspection.

v2: Add description per Konrad's suggestion, thanks.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
---
 tools/firmware/rombios/rombios.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/firmware/rombios/rombios.c b/tools/firmware/rombios/rombios.c
index 057aced..f5ac33e 100644
--- a/tools/firmware/rombios/rombios.c
+++ b/tools/firmware/rombios/rombios.c
@@ -10648,7 +10648,7 @@ rom_scan_increment:
   add  cx, ax
   pop  ax       ;; Restore AX
   cmp  cx, ax
-  jbe  rom_scan_loop
+  jb  rom_scan_loop
 
   xor  ax, ax   ;; Restore DS back to 0000:
   mov  ds, ax
@@ -11022,7 +11022,7 @@ post_default_ints:
   call post_init_pic
 
   mov  cx, #0xc000  ;; init vga bios
-  mov  ax, #0xc780
+  mov  ax, #0xc800
   call rom_scan
 
   call _print_bios_banner
-- 
1.7.3

^ permalink raw reply related	[flat|nested] only message in thread

only message in thread, other threads:[~2013-08-20  6:38 UTC | newest]

Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-08-20  6:38 [PATCH v2] Minor change to avoid potental overflow accessing pci option roms Zhenzhong Duan

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).