Browse Source

Add Bounds Check to md.asm, Issue #560

Added checks to prevent HBIOS API read/write calls from access RAM or ROM banks outside of the banks allocated for RAM/ROM disk.
pull/563/head
Wayne Warthen 8 months ago
parent
commit
2f5cf8fce4
No known key found for this signature in database GPG Key ID: 8B34ED29C07EEB0A
  1. 1
      Doc/ChangeLog.txt
  2. 35
      Source/HBIOS/md.asm

1
Doc/ChangeLog.txt

@ -8,6 +8,7 @@ Version 3.6
- WBW: Add -DELAY option to TUNE app (per Robb Bates) - WBW: Add -DELAY option to TUNE app (per Robb Bates)
- R?G: Add online documentation site - R?G: Add online documentation site
- WBW: Added enhanced Hi-Tech C Compiler files from Ladislau Szilagyi - WBW: Added enhanced Hi-Tech C Compiler files from Ladislau Szilagyi
- WBW: Added boundary check to ram/rom disk driver
Version 3.5.1 Version 3.5.1
------------- -------------

35
Source/HBIOS/md.asm

@ -359,6 +359,7 @@ MD_RDSECF: ; CALLED FROM MD_RW
; SAVE THE 4K LBA FOR FUTURE CHECKS ; SAVE THE 4K LBA FOR FUTURE CHECKS
; ;
CALL MD_CALBAS ; SETUP BANK AND SECTOR CALL MD_CALBAS ; SETUP BANK AND SECTOR
RET NZ ; RETURN IF ERROR
; ;
LD IX,MD_F4KBUF ; SET DESTINATION ADDRESS LD IX,MD_F4KBUF ; SET DESTINATION ADDRESS
LD HL,MD_FREAD_R ; PUT ROUTINE TO CALL LD HL,MD_FREAD_R ; PUT ROUTINE TO CALL
@ -467,7 +468,18 @@ MD_CALBAS:
CALL PRTHEXWORD ; DISPLAY BANK AND CALL PRTHEXWORD ; DISPLAY BANK AND
CALL PC_SPACE ; SECTOR RESULT CALL PC_SPACE ; SECTOR RESULT
#ENDIF #ENDIF
;
; CHECK FOR ACCESS BEYOND AVAILABLE ROM BANKS
LD A,B ; BANK ID TO ACCUM
SUB BID_ROMD0 ; ZERO OFFSET
CP ROMD_BNKS ; CHECK FOR OUT OF BOUNDS
JR C,MD_CALBAS1 ; IF NOT, CONTINUE
LD A,ERR_IO ; ELSE SIGNAL IO ERROR
OR A ; SET FLAGS
RET ; AND RETURN
;
MD_CALBAS1:
XOR A ; SIGNAL SUCCESS
RET RET
; ;
; WRITE FLASH ; WRITE FLASH
@ -485,6 +497,7 @@ MD_WRSECF: ; CALLED FROM MD_RW
LD (MD_LBA4K),BC ; SAVE 4K LBA LD (MD_LBA4K),BC ; SAVE 4K LBA
; ;
CALL MD_CALBAS ; SETUP BANK AND SECTOR CALL MD_CALBAS ; SETUP BANK AND SECTOR
RET NZ ; RETURN ON ERROR
; ;
LD IX,MD_F4KBUF ; SET DESTINATION ADDRESS LD IX,MD_F4KBUF ; SET DESTINATION ADDRESS
LD HL,MD_FREAD_R ; PUT ROUTINE TO CALL LD HL,MD_FREAD_R ; PUT ROUTINE TO CALL
@ -566,6 +579,12 @@ MD_FBAS .DW $FFFF ; BANK AND SECTOR
; ;
MD_RDSEC: MD_RDSEC:
CALL MD_IOSETUP ; SETUP FOR MEMORY COPY CALL MD_IOSETUP ; SETUP FOR MEMORY COPY
CP $FF ; ERROR?
JR NZ,MD_RDSEC1 ; IF NOT, CONTINUE
LD A,ERR_IO ; SIGNAL IO ERROR
OR A ; SET FLAGS
RET ; AND DONE
MD_RDSEC1:
#IF (MDTRACE >= 2) #IF (MDTRACE >= 2)
LD (MD_SRC),HL LD (MD_SRC),HL
LD (MD_DST),DE LD (MD_DST),DE
@ -597,6 +616,12 @@ MD_RDSEC:
; ;
MD_WRSEC: MD_WRSEC:
CALL MD_IOSETUP ; SETUP FOR MEMORY COPY CALL MD_IOSETUP ; SETUP FOR MEMORY COPY
CP $FF ; ERROR?
JR NZ,MD_WRSEC1 ; IF NOT, CONTINUE
LD A,ERR_IO ; SIGNAL IO ERROR
OR A ; SET FLAGS
RET ; AND DONE
MD_WRSEC1:
EX DE,HL ; SWAP SRC/DEST FOR WRITE EX DE,HL ; SWAP SRC/DEST FOR WRITE
#IF (MDTRACE >= 2) #IF (MDTRACE >= 2)
LD (MD_SRC),HL LD (MD_SRC),HL
@ -682,13 +707,21 @@ MD_IOSETUP:
JR Z,MD_IOSETUP2 ; DO ROM DRIVE, ELSE FALL THRU FOR RAM DRIVE JR Z,MD_IOSETUP2 ; DO ROM DRIVE, ELSE FALL THRU FOR RAM DRIVE
; ;
MD_IOSETUP1: ; ROM MD_IOSETUP1: ; ROM
CP ROMD_BNKS ; WITHIN AVAILABLE ROM DISK BANKS?
JR NC,MD_IOSETUP3 ; HANDLE OUT OF BOUNDS
ADD A,BID_ROMD0 ADD A,BID_ROMD0
RET RET
; ;
MD_IOSETUP2: ; RAM MD_IOSETUP2: ; RAM
CP RAMD_BNKS ; WITHIN AVAILABLE ROM DISK BANKS?
JR NC,MD_IOSETUP3 ; HANDLE OUT OF BOUNDS
ADD A,BID_RAMD0 ADD A,BID_RAMD0
RET RET
; ;
MD_IOSETUP3:
OR $FF ; SIGNAL ERROR
RET ; DONE
;
; ;
; ;
#IF (MDTRACE >= 2) #IF (MDTRACE >= 2)

Loading…
Cancel
Save