[2589] 2009-09-12 Robert Millan <address@hidden>

[Robert Millan]

Revision: 2589
          http://svn.sv.gnu.org/viewvc/?view=rev&root=grub&revision=2589
Author:   robertmh
Date:     2009-09-12 13:05:25 +0000 (Sat, 12 Sep 2009)
Log Message:
-----------
2009-09-12  Robert Millan  <address@hidden>

        Fix memory corruption issue (spotted by Colin Watson).

        * kern/i386/pc/startup.S (grub_vbe_bios_getset_dac_palette): Fix bug
        causing returned size to be stored in an incorrect memory location.
        Fix use of uninitialized value when storing the returned size.

Modified Paths:
--------------
    trunk/grub2/ChangeLog
    trunk/grub2/kern/i386/pc/startup.S

Modified: trunk/grub2/ChangeLog
===================================================================
--- trunk/grub2/ChangeLog       2009-09-12 07:38:50 UTC (rev 2588)
+++ trunk/grub2/ChangeLog       2009-09-12 13:05:25 UTC (rev 2589)
@@ -1,3 +1,11 @@
+2009-09-12  Robert Millan  <address@hidden>
+
+       Fix memory corruption issue (spotted by Colin Watson).
+
+       * kern/i386/pc/startup.S (grub_vbe_bios_getset_dac_palette): Fix bug
+       causing returned size to be stored in an incorrect memory location.
+       Fix use of uninitialized value when storing the returned size.
+
 2009-09-12  Yves Blusseau  <address@hidden>
 
        Change clean rules to properly remove files

Modified: trunk/grub2/kern/i386/pc/startup.S
===================================================================
--- trunk/grub2/kern/i386/pc/startup.S  2009-09-12 07:38:50 UTC (rev 2588)
+++ trunk/grub2/kern/i386/pc/startup.S  2009-09-12 13:05:25 UTC (rev 2589)
@@ -1761,18 +1761,18 @@
        movw    $0x4f08, %ax
        int     $0x10
 
-       movw    %ax, %dx        /* real_to_prot destroys %eax.  */
+       movw    %ax, %cx        /* real_to_prot destroys %eax.  */
 
        DATA32 call     real_to_prot
        .code32
 
        /* Move result back to *dac_mask_size.  */
+       xorl    %eax, %eax
        movb    %bh, %al
        movl    %eax, (%edx)
 
        /* Return value in %eax.  */
-       xorl    %eax, %eax
-       movw    %dx, %ax
+       movw    %cx, %ax
 
        popl    %ebx
        popl    %ebp