Skip to content

Commit 7d42c6c

Browse files
authored
Basic fix for pc_chd support in imgtool (#14148)
* imgtool: Take ownership of stream in pc_chd_image_open `imgtool::image::internal_open` passes an rvalue reference to the stream to the `open` function of the image format module. It expects the `open` function to take ownership if it keeps a reference to the stream. If `open` does not do so, the `stream` is going to be destroyed at the end of `internal_open`. `pc_chd_image_open` fails to take ownership, yet it persists a reference to the stream as part of `info->hard_disk`. This causes an use-after-free condition * imgtool: Correct determination of total sectors of a FAT volume The number of total sectors of a FAT volume is stored either in the 16-bit word at offset 19 or, if that word is zero, in the 32-bit word at offset 32 instead. The 32-bit word is not a high word to build a 48-bit value in conjunction with the 16-bit word at offset 19, but it supersedes it.
1 parent b6adee8 commit 7d42c6c

File tree

2 files changed

+2
-1
lines changed

2 files changed

+2
-1
lines changed

src/tools/imgtool/modules/fat.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -436,7 +436,7 @@ static imgtoolerr_t fat_partition_open(imgtool::partition &partition, uint64_t f
436436
if (info->sectors_per_cluster == 0)
437437
return IMGTOOLERR_CORRUPTIMAGE;
438438

439-
info->total_sectors = total_sectors_l + (uint64_t(total_sectors_h) << 16);
439+
info->total_sectors = total_sectors_l != 0 ? total_sector_l : total_sectors_h;
440440
available_sectors = info->total_sectors - info->reserved_sectors
441441
- (info->sectors_per_fat * info->fat_count)
442442
- (info->root_entries * FAT_DIRENT_SIZE + FAT_SECLEN - 1) / FAT_SECLEN;

src/tools/imgtool/modules/pc_hard.cpp

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -292,6 +292,7 @@ static imgtoolerr_t pc_chd_image_open(imgtool::image &image, imgtool::stream::pt
292292
if (err)
293293
return err;
294294
295+
stream.release();
295296
return IMGTOOLERR_SUCCESS;
296297
}
297298

0 commit comments

Comments
 (0)