hrev48154 adds 1 changeset to branch 'master' old head: c3f81329bb1bfcb22b0b59c3a7f66667c6f0c04b new head: a2647907273fff22997169ac2fcddeceda8f60e1 overview: http://cgit.haiku-os.org/haiku/log/?qt=range&q=a264790+%5Ec3f8132 ---------------------------------------------------------------------------- a264790: writembr: Fix too short MBR due to wrong compile flags. The compile flags were set so that only the boot code itself would be produced, excluding the (dummy) partition table and signature. The code in writembr still assumed that the MBR would be 512 bytes however and therefore access the data array out of bounds. Fix flags to produce the full 512 byte MBR sector and add a STATIC_ASSERT so that the size assumption is checked on compilation. Also fix a typo in mbr.nasm, mostly to trigger re-generation of the MBR data that one would otherwise need to remove manually... The two out of bounds array accesses were pointed out by CID 1249923 and CID 1249924, the insufficiently large target buffer of the memcpy by CID 1249901. [ Michael Lotz <mmlr@xxxxxxxx> ] ---------------------------------------------------------------------------- Revision: hrev48154 Commit: a2647907273fff22997169ac2fcddeceda8f60e1 URL: http://cgit.haiku-os.org/haiku/commit/?id=a264790 Author: Michael Lotz <mmlr@xxxxxxxx> Date: Wed Oct 29 21:38:18 2014 UTC ---------------------------------------------------------------------------- 3 files changed, 5 insertions(+), 2 deletions(-) src/bin/writembr/Jamfile | 2 +- src/bin/writembr/mbr.nasm | 2 +- src/bin/writembr/writembr.cpp | 3 +++ ---------------------------------------------------------------------------- diff --git a/src/bin/writembr/Jamfile b/src/bin/writembr/Jamfile index 2674876..6c33228 100644 --- a/src/bin/writembr/Jamfile +++ b/src/bin/writembr/Jamfile @@ -10,7 +10,7 @@ Application writembr : # Assemble the MBR code, and convert it into a header file -NASMFLAGS on [ FGristFiles mbr.bin ] = -f bin -O5 -dMBR_CODE_ONLY=1 ; +NASMFLAGS on [ FGristFiles mbr.bin ] = -f bin -O5 ; Object [ FGristFiles mbr.bin ] : mbr.nasm ; diff --git a/src/bin/writembr/mbr.nasm b/src/bin/writembr/mbr.nasm index 0aab120..64bad16 100644 --- a/src/bin/writembr/mbr.nasm +++ b/src/bin/writembr/mbr.nasm @@ -218,7 +218,7 @@ found_active: ; active partition (pointed by si) mov [address_packet+AddressPacket.sector],eax ; if LBA_adress equals 0 then it's not a valid PBR (it is the MBR) - ; this can append when we only have a CHS adress in the partition entry + ; this can happen when we only have a CHS adress in the partition entry test eax, eax ;if ( LBA_adress == 0 ) jz no_disk_extentions ;then no_disk_extentions() diff --git a/src/bin/writembr/writembr.cpp b/src/bin/writembr/writembr.cpp index 5526b0f..1661683 100644 --- a/src/bin/writembr/writembr.cpp +++ b/src/bin/writembr/writembr.cpp @@ -9,6 +9,7 @@ #include <string.h> #include <string> +#include <Debug.h> #include <DiskDevice.h> #include <DiskDeviceRoster.h> #include <Path.h> @@ -73,6 +74,8 @@ main(int argc, char** argv) return B_ERROR; } + STATIC_ASSERT(kMBRSize == 512); + unsigned char MBR[kMBRSize]; fs.read((char*)MBR, kMBRSize); if (fs.fail() || fs.gcount() < kMBRSize ) {