:: commit 249d05893181f5e4cc2d4c3a10b3679f20acabfa

mintsuki <mintsuki@protonmail.com> — 2021-03-06 02:57

parents: 32a4539313

limine-install: Fix buffer overflow bug with new stage 2 alignments

diff --git a/limine-install.c b/limine-install.c
index 0dca4e0a..31b63b5a 100644
--- a/limine-install.c
+++ b/limine-install.c
@@ -329,8 +329,6 @@ int main(int argc, char *argv[]) {
     // Default split of stage2 for MBR (consecutive in post MBR gap)
     uint64_t stage2_loc_a = 512;
     uint64_t stage2_loc_b = stage2_loc_a + stage2_size_a;
-    if (stage2_loc_b & (512 - 1))
-        stage2_loc_b = (stage2_loc_b + 512) & ~(512 - 1);
 
     if (gpt) {
         if (argc > 3) {
@@ -453,7 +451,7 @@ int main(int argc, char *argv[]) {
     // Write the rest of stage 2 to the device
     device_write(&bootloader_img[512], stage2_loc_a, stage2_size_a);
     device_write(&bootloader_img[512 + stage2_size_a],
-                 stage2_loc_b, stage2_size_b);
+                 stage2_loc_b, stage2_size - stage2_size_a);
 
     // Hardcode in the bootsector the location of stage 2 halves
     device_write(&stage2_size_a, 0x1a4 + 0,  sizeof(uint16_t));
tab: 248 wrap: offon