[PATCH] Fix bug causing truncation of files in cbfs_copyfile().
Fix bug causing truncation of uncompressed files that had a size not a multiple of 4. Make sure to allocate extra space for jpeg temp location in bootsplash code. --- src/bootsplash.c | 2 +- src/coreboot.c | 6 +++--- src/util.c | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/bootsplash.c b/src/bootsplash.c index ed10415..9dcdd99 100644 --- a/src/bootsplash.c +++ b/src/bootsplash.c @@ -119,7 +119,7 @@ void enable_vga_console(void) struct cbfs_file *file = cbfs_finddatafile("bootsplash.jpg"); if (!file) goto gotext; - int filesize = cbfs_datasize(file); + int filesize = ALIGN(cbfs_datasize(file), 4); int imagesize = (CONFIG_BOOTSPLASH_X * CONFIG_BOOTSPLASH_Y * (CONFIG_BOOTSPLASH_DEPTH / 8)); diff --git a/src/coreboot.c b/src/coreboot.c index 5d9a101..207c4a4 100644 --- a/src/coreboot.c +++ b/src/coreboot.c @@ -507,10 +507,10 @@ cbfs_copyfile(struct cbfs_file *file, void *dst, u32 maxlen) return -1; u32 size = ntohl(file->len); + u32 asize = ALIGN(size, 4); void *src = (void*)file + ntohl(file->offset); if (cbfs_iscomp(file)) { // Compressed - copy to temp ram and uncompress it. - u32 asize = ALIGN(size, 4); void *temp = malloc_tmphigh(asize); if (!temp) return -1; @@ -523,11 +523,11 @@ cbfs_copyfile(struct cbfs_file *file, void *dst, u32 maxlen) // Not compressed. dprintf(3, "Copying data %d@%p to %d@%p\n", size, src, maxlen, dst); - if (size > maxlen) { + if (asize > maxlen) { warn_noalloc(); return -1; } - iomemcpy(dst, src, size); + iomemcpy(dst, src, asize); return size; } diff --git a/src/util.c b/src/util.c index 2c22dfc..d99bf06 100644 --- a/src/util.c +++ b/src/util.c @@ -202,7 +202,7 @@ memcpy(void *d1, const void *s1, size_t len) return d1; } -// Copy from memory mapped IO. IO mem is very slow, so yield +// Copy to/from memory mapped IO. IO mem is very slow, so yield // periodically. 'len' must be 4 byte aligned. void iomemcpy(void *d, const void *s, u32 len) -- 1.7.1.1
Scratch the previous patch - it's simpler to just enhance iomemcpy. -Kevin
From b4525a0ec176426788f293cce92160e6573e86b6 Mon Sep 17 00:00:00 2001 From: Kevin O'Connor <kevin@koconnor.net> Date: Tue, 27 Jul 2010 01:14:11 -0400 Subject: [PATCH] Handle unaligned sizes in iomemcpy(). To: seabios@seabios.org
This fixes a bug causing truncation of uncompressed files in cbfs_copyfile(). --- src/coreboot.c | 5 ++--- src/util.c | 11 +++++++---- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/src/coreboot.c b/src/coreboot.c index 5d9a101..db0063b 100644 --- a/src/coreboot.c +++ b/src/coreboot.c @@ -510,11 +510,10 @@ cbfs_copyfile(struct cbfs_file *file, void *dst, u32 maxlen) void *src = (void*)file + ntohl(file->offset); if (cbfs_iscomp(file)) { // Compressed - copy to temp ram and uncompress it. - u32 asize = ALIGN(size, 4); - void *temp = malloc_tmphigh(asize); + void *temp = malloc_tmphigh(size); if (!temp) return -1; - iomemcpy(temp, src, asize); + iomemcpy(temp, src, size); int ret = ulzma(dst, maxlen, temp, size); yield(); free(temp); diff --git a/src/util.c b/src/util.c index 2c22dfc..8e02d1e 100644 --- a/src/util.c +++ b/src/util.c @@ -202,24 +202,27 @@ memcpy(void *d1, const void *s1, size_t len) return d1; } -// Copy from memory mapped IO. IO mem is very slow, so yield -// periodically. 'len' must be 4 byte aligned. +// Copy to/from memory mapped IO. IO mem is very slow, so yield +// periodically. void iomemcpy(void *d, const void *s, u32 len) { yield(); - while (len) { + while (len > 3) { u32 copylen = len; if (copylen > 2048) copylen = 2048; - len -= copylen; copylen /= 4; + len -= copylen * 4; asm volatile( "rep movsl (%%esi),%%es:(%%edi)" : "+c"(copylen), "+S"(s), "+D"(d) : : "cc", "memory"); yield(); } + if (len) + // Copy any remaining bytes. + memcpy(d, s, len); } void * -- 1.7.1.1
participants (1)
-
Kevin O'Connor