Date:	Thu, 1 Feb 1996 18:13:11 +0200 (IST)
From:	Eli Zaretskii <eliz AT is DOT elta DOT co DOT il>
To:	"A.Appleyard" <A DOT APPLEYARD AT fs2 DOT mt DOT umist DOT ac DOT uk>
Cc:	DJGPP AT sun DOT soe DOT clarkson DOT edu, djgpp-workers AT delorie DOT com
Subject:	Re: bug in getmntent()

On Thu, 1 Feb 1996, A.Appleyard wrote:

> I may have found a bug in getmntent() (a v2 function which finds information
> about a drive). It has a component function static int get_stacker_info(int
[snip]
> But on my PC, stac_driver_ptr here is neither the original 0xbadabada, nor any
> pointer, but 0xffffffff:0xffffffff, thus causing an illegal address abort. My

Thank you for reporting this.  Here is the fix:

*** mntent.c~0	Fri Jul  7 07:51:06 1995
--- mntent.c	Thu Feb  1 17:48:34 1996
*************** get_stacker_info(int drive_num)
*** 195,204 ****
    if ((stac_driver_ptr = _farpeekl(dos_mem_base, tb)) == 0xbadabadaU)
      return 0;
  
!   /* This drive IS compressed with Stacker.  Construct a linear address
!      of the far pointer into the Stacker device driver.  */
    stac_driver_ptr = ((stac_driver_ptr >> 12) & 0xffff0)
                      + (stac_driver_ptr & 0xffff);
  
    /* Stacker Anywhere returns pointer to 1 byte before the A55Ah
       signature (which is at offset 1Ah), while all other versions
--- 195,210 ----
    if ((stac_driver_ptr = _farpeekl(dos_mem_base, tb)) == 0xbadabadaU)
      return 0;
  
!   /* This drive MIGHT be compressed with Stacker.  Construct a linear
!      address of the far pointer into the Stacker device driver.  */
    stac_driver_ptr = ((stac_driver_ptr >> 12) & 0xffff0)
                      + (stac_driver_ptr & 0xffff);
+ 
+   /* Sanity check: real-mode addresses are only 20 bit-long, so we can
+      safely reject anything that's larger than FFFFFh, lest we get an
+      illegal address abort when we try to peek at the signature below.  */
+   if (stac_driver_ptr > 0xfffff)
+     return 0;
  
    /* Stacker Anywhere returns pointer to 1 byte before the A55Ah
       signature (which is at offset 1Ah), while all other versions

- Raw text -