Fix overflow and add more dprintfs

diff --git a/lib/relocator.c b/lib/relocator.c
index 6fbdb71d7a174d86101ecfd4be51853bc4243c6b..5772ccc7dfc2f3b6415a201c3aaca0ad57829f7a 100644 (file)
--- a/lib/relocator.c
+++ b/lib/relocator.c
@@ -200,15 +200,21 @@ allocate_inreg (grub_phys_addr_t paddr, grub_size_t size,
 {
   struct grub_mm_header *foll = NULL;
   grub_addr_t vaddr = (grub_addr_t) hb + (paddr - grub_vtop (hb));
+
+  grub_dprintf ("relocator",
+               "inreg paddr = 0x%x, size = %d, hb = %p, hbp = %p, rb = %p, vaddr = 0x%x\n",
+               paddr, size, hb, hbp, rb, vaddr);
     
   if (ALIGN_UP (vaddr + size, GRUB_MM_ALIGN) + GRUB_MM_ALIGN
       <= (grub_addr_t) (hb + hb->size))
     {
       foll = (void *) ALIGN_UP (vaddr + size, GRUB_MM_ALIGN);
       foll->magic = GRUB_MM_FREE_MAGIC;
-      foll->size = hb->size - (foll - hb);
+      foll->size = hb + hb->size - foll;
     }
 
+  grub_dprintf ("relocator", "foll = %p, foll->size = %d\n", foll, foll->size);
+
   if (vaddr - (grub_addr_t) hb >= sizeof (*hb))
     {
       hb->size = ((vaddr - (grub_addr_t) hb) >> GRUB_MM_ALIGN_LOG2);
@@ -431,12 +437,16 @@ malloc_in_range (struct grub_relocator *rel,
       p = r->first;
       do
        {
+         if ((grub_addr_t) p < (grub_addr_t) (r + 1)
+             || (grub_addr_t) p >= (grub_addr_t) (r + 1) + r->size)
+           grub_fatal ("%d: out of range pointer: %p\n", __LINE__, p);
          maxevents += 2;
          p = p->next;
        }
       while (p != r->first);
       maxevents += 4;
     }
+
   if (collisioncheck && rel)
     {
       struct grub_relocator_chunk *chunk;
@@ -617,6 +627,7 @@ malloc_in_range (struct grub_relocator *rel,
     eventt = events;
     events = t;
   }
+
   {
     unsigned i;
     for (i = 0; i < (BITS_IN_BYTE * sizeof (grub_addr_t) / DIGITSORT_BITS);
@@ -1146,6 +1157,7 @@ malloc_in_range (struct grub_relocator *rel,
   res->size = size;
   grub_dprintf ("relocator", "allocated: 0x%lx+0x%lx\n", (unsigned long) target,
                (unsigned long) size);
+
   return 1;
 }
 
@@ -1190,7 +1202,6 @@ grub_relocator_alloc_chunk_addr (struct grub_relocator *rel,
        || (target <= chunk->target && chunk->target < target + size))
       return grub_error (GRUB_ERR_BAD_ARGUMENT, "overlap detected");
 
-
   chunk = grub_malloc (sizeof (struct grub_relocator_chunk));
   if (!chunk)
     return grub_errno;