[2589] 2009-09-12 Robert Millan <[email protected]>

Revision: 2589
          http://svn.sv.gnu.org/viewvc/?view=rev&root=grub&revision=2589
Author:   robertmh
Date:     2009-09-12 13:05:25 +0000 (Sat, 12 Sep 2009)
Log Message:
-----------
2009-09-12  Robert Millan  <[email protected]>

        Fix memory corruption issue (spotted by Colin Watson).

        * kern/i386/pc/startup.S (grub_vbe_bios_getset_dac_palette): Fix bug
        causing returned size to be stored in an incorrect memory location.
        Fix use of uninitialized value when storing the returned size.

Modified Paths:
--------------
    trunk/grub2/ChangeLog
    trunk/grub2/kern/i386/pc/startup.S

Modified: trunk/grub2/ChangeLog
===================================================================
--- trunk/grub2/ChangeLog	2009-09-12 07:38:50 UTC (rev 2588)
+++ trunk/grub2/ChangeLog	2009-09-12 13:05:25 UTC (rev 2589)
@@ -1,3 +1,11 @@
+2009-09-12  Robert Millan  <[email protected]>
+
+	Fix memory corruption issue (spotted by Colin Watson).
+
+	* kern/i386/pc/startup.S (grub_vbe_bios_getset_dac_palette): Fix bug
+	causing returned size to be stored in an incorrect memory location.
+	Fix use of uninitialized value when storing the returned size.
+
 2009-09-12  Yves Blusseau  <[email protected]>
 
 	Change clean rules to properly remove files

Modified: trunk/grub2/kern/i386/pc/startup.S
===================================================================
--- trunk/grub2/kern/i386/pc/startup.S	2009-09-12 07:38:50 UTC (rev 2588)
+++ trunk/grub2/kern/i386/pc/startup.S	2009-09-12 13:05:25 UTC (rev 2589)
@@ -1761,18 +1761,18 @@
 	movw	$0x4f08, %ax
 	int	$0x10
 
-	movw	%ax, %dx	/* real_to_prot destroys %eax.  */
+	movw	%ax, %cx	/* real_to_prot destroys %eax.  */
 
 	DATA32 call	real_to_prot
 	.code32
 
 	/* Move result back to *dac_mask_size.  */
+	xorl	%eax, %eax
 	movb	%bh, %al
 	movl	%eax, (%edx)
 
 	/* Return value in %eax.  */
-	xorl	%eax, %eax
-	movw	%dx, %ax
+	movw	%cx, %ax
 
 	popl	%ebx
 	popl	%ebp