From a2647907273fff22997169ac2fcddeceda8f60e1 Mon Sep 17 00:00:00 2001 From: Michael Lotz Date: Wed, 29 Oct 2014 22:38:18 +0100 Subject: [PATCH] writembr: Fix too short MBR due to wrong compile flags. The compile flags were set so that only the boot code itself would be produced, excluding the (dummy) partition table and signature. The code in writembr still assumed that the MBR would be 512 bytes however and therefore access the data array out of bounds. Fix flags to produce the full 512 byte MBR sector and add a STATIC_ASSERT so that the size assumption is checked on compilation. Also fix a typo in mbr.nasm, mostly to trigger re-generation of the MBR data that one would otherwise need to remove manually... The two out of bounds array accesses were pointed out by CID 1249923 and CID 1249924, the insufficiently large target buffer of the memcpy by CID 1249901. --- src/bin/writembr/Jamfile | 2 +- src/bin/writembr/mbr.nasm | 2 +- src/bin/writembr/writembr.cpp | 3 +++ 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/src/bin/writembr/Jamfile b/src/bin/writembr/Jamfile index 2674876573..6c33228b4f 100644 --- a/src/bin/writembr/Jamfile +++ b/src/bin/writembr/Jamfile @@ -10,7 +10,7 @@ Application writembr : # Assemble the MBR code, and convert it into a header file -NASMFLAGS on [ FGristFiles mbr.bin ] = -f bin -O5 -dMBR_CODE_ONLY=1 ; +NASMFLAGS on [ FGristFiles mbr.bin ] = -f bin -O5 ; Object [ FGristFiles mbr.bin ] : mbr.nasm ; diff --git a/src/bin/writembr/mbr.nasm b/src/bin/writembr/mbr.nasm index 0aab120516..64bad167ef 100644 --- a/src/bin/writembr/mbr.nasm +++ b/src/bin/writembr/mbr.nasm @@ -218,7 +218,7 @@ found_active: ; active partition (pointed by si) mov [address_packet+AddressPacket.sector],eax ; if LBA_adress equals 0 then it's not a valid PBR (it is the MBR) - ; this can append when we only have a CHS adress in the partition entry + ; this can happen when we only have a CHS adress in the partition entry test eax, eax ;if ( LBA_adress == 0 ) jz no_disk_extentions ;then no_disk_extentions() diff --git a/src/bin/writembr/writembr.cpp b/src/bin/writembr/writembr.cpp index 5526b0f6da..1661683729 100644 --- a/src/bin/writembr/writembr.cpp +++ b/src/bin/writembr/writembr.cpp @@ -9,6 +9,7 @@ #include #include +#include #include #include #include @@ -73,6 +74,8 @@ main(int argc, char** argv) return B_ERROR; } + STATIC_ASSERT(kMBRSize == 512); + unsigned char MBR[kMBRSize]; fs.read((char*)MBR, kMBRSize); if (fs.fail() || fs.gcount() < kMBRSize ) {