Chameleon

Chameleon Commit Details

Date:2014-01-07 09:33:32 (10 years 3 months ago)
Author:Chuck Fry
Commit:2309
Parents: 2308
Message:Improve robustness against buffer overruns
Changes:
M/branches/chucko/i386/boot2/drivers.c

File differences

branches/chucko/i386/boot2/drivers.c
244244
245245
246246
247
247
248248
249249
250250
251
251
252252
253253
254254
......
278278
279279
280280
281
281
282282
283283
284284
......
289289
290290
291291
292
292
293293
294294
295295
......
336336
337337
338338
339
339
340340
341341
342
342
343343
344344
345345
346346
347347
348
349
348
349
350350
351351
352352
......
383383
384384
385385
386
386
387387
388388
389389
......
436436
437437
438438
439
439
440440
441441
442442
......
460460
461461
462462
463
464
465
466
463
464
465
466
467
468
467469
468470
469471
470472
471473
472474
473
474
475
476
477
478
475479
476480
477481
......
481485
482486
483487
484
485
486
487
488
489
490
491
492
493
488494
489495
490496
......
574580
575581
576582
577
583
578584
579585
580586
......
629635
630636
631637
632
638
633639
634640
635641
else
{
if (gMacOSVersion[3] == '9') {
strcpy(gExtensionsSpec, dirSpec);
strlcpy(gExtensionsSpec, dirSpec, 4087); /* 4096 - sizeof("Library/") */
strcat(gExtensionsSpec, "Library/");
FileLoadDrivers(gExtensionsSpec, 0);
}
strcpy(gExtensionsSpec, dirSpec);
strlcpy(gExtensionsSpec, dirSpec, 4080); /* 4096 - sizeof("System/Library/") */
strcat(gExtensionsSpec, "System/Library/");
FileLoadDrivers(gExtensionsSpec, 0);
}
longret, flags, time, time2;
charaltDirSpec[512];
sprintf (altDirSpec, "%s%s", dirSpec, extDirSpec);
snprintf(altDirSpec, sizeof(altDirSpec), "%s%s", dirSpec, extDirSpec);
ret = GetFileInfo(altDirSpec, "Extensions.mkext", &flags, &time);
if ((ret == 0) && ((flags & kFileTypeMask) == kFileTypeFlat))
|| ((flags & kFileTypeMask) != kFileTypeDirectory)
|| (((gBootMode & kBootModeSafe) == 0) && (time == (time2 + 1))))
{
sprintf(gDriverSpec, "%sExtensions.mkext", altDirSpec);
snprintf(gDriverSpec, sizeof(altDirSpec) + 18, "%sExtensions.mkext", altDirSpec);
verbose("LoadDrivers: Loading from [%s]\n", gDriverSpec);
if (LoadDriverMKext(gDriverSpec) == 0)
if (strcmp(name + length - 5, ".kext")) continue;
// Save the file name.
strcpy(gFileName, name);
strlcpy(gFileName, name, 4096);
// Determine the bundle type.
sprintf(gTempSpec, "%s/%s", dirSpec, gFileName);
snprintf(gTempSpec, 4096, "%s/%s", dirSpec, gFileName);
ret = GetFileInfo(gTempSpec, "Contents", &flags, &time);
if (ret == 0) bundleType = kCFBundleType2;
else bundleType = kCFBundleType3;
if (!plugin)
sprintf(gDriverSpec, "%s/%s/%sPlugIns", dirSpec, gFileName,
(bundleType == kCFBundleType2) ? "Contents/" : "");
snprintf(gDriverSpec, 4096, "%s/%s/%sPlugIns", dirSpec, gFileName,
(bundleType == kCFBundleType2) ? "Contents/" : "");
ret = LoadDriverPList(dirSpec, gFileName, bundleType);
#endif
// INTEL modification
sprintf(gDriverSpec, "%s%s.mkext", dirSpec, bootInfo->bootFile);
snprintf(gDriverSpec, 4096, "%s%s.mkext", dirSpec, bootInfo->bootFile);
verbose("NetLoadDrivers: Loading from [%s]\n", gDriverSpec);
memcpy((void *)driversAddr, (void *)package, driversLength);
// Add the MKext to the memory map.
sprintf(segName, "DriversPackage-%lx", driversAddr);
snprintf(segName, sizeof(segName), "DriversPackage-%lx", driversAddr);
AllocateMemoryRange(segName, driversAddr, driversLength,
kBootDriverTypeMKEXT);
do {
// Save the driver path.
if(name) sprintf(gFileSpec, "%s/%s/%s", dirSpec, name,
(bundleType == kCFBundleType2) ? "Contents/MacOS/" : "");
else sprintf(gFileSpec, "%s/%s", dirSpec,
(bundleType == kCFBundleType2) ? "Contents/MacOS/" : "");
if(name)
snprintf(gFileSpec, 4096, "%s/%s/%s", dirSpec, name,
(bundleType == kCFBundleType2) ? "Contents/MacOS/" : "");
else
snprintf(gFileSpec, 4096, "%s/%s", dirSpec,
(bundleType == kCFBundleType2) ? "Contents/MacOS/" : "");
executablePathLength = strlen(gFileSpec) + 1;
tmpExecutablePath = malloc(executablePathLength);
if (tmpExecutablePath == 0) break;
strcpy(tmpExecutablePath, gFileSpec);
if(name) sprintf(gFileSpec, "%s/%s", dirSpec, name);
else sprintf(gFileSpec, "%s", dirSpec);
if(name)
snprintf(gFileSpec, 4096, "%s/%s", dirSpec, name);
else
snprintf(gFileSpec, 4096, "%s", dirSpec);
bundlePathLength = strlen(gFileSpec) + 1;
tmpBundlePath = malloc(bundlePathLength);
// Construct the file spec to the plist, then load it.
if(name) sprintf(gFileSpec, "%s/%s/%sInfo.plist", dirSpec, name,
(bundleType == kCFBundleType2) ? "Contents/" : "");
else sprintf(gFileSpec, "%s/%sInfo.plist", dirSpec,
(bundleType == kCFBundleType2) ? "Contents/" : "");
if(name)
snprintf(gFileSpec, 4096, "%s/%s/%sInfo.plist", dirSpec, name,
(bundleType == kCFBundleType2) ? "Contents/" : "");
else
snprintf(gFileSpec, 4096, "%s/%sInfo.plist", dirSpec,
(bundleType == kCFBundleType2) ? "Contents/" : "");
length = LoadFile(gFileSpec);
if (length == -1) break;
if (prop != 0)
{
fileName = prop->string;
sprintf(gFileSpec, "%s%s", module->executablePath, fileName);
snprintf(gFileSpec, 4096, "%s%s", module->executablePath, fileName);
length = LoadThinFatFile(gFileSpec, &executableAddr);
if (length == 0)
{
strcpy(driver->bundlePathAddr, module->bundlePath);
// Add an entry to the memory map.
sprintf(segName, "Driver-%lx", (unsigned long)driver);
snprintf(segName, sizeof(segName), "Driver-%lx", (unsigned long)driver);
AllocateMemoryRange(segName, driverAddr, driverLength,
kBootDriverTypeKEXT);
}

Archive Download the corresponding diff file

Revision: 2309