mirrors/hekate
1
0
Fork 0
mirror of https://github.com/CTCaer/hekate.git synced 2024-11-26 11:42:09 +00:00
Code Issues Releases Activity

ini: Fix heap corruption caused by backlight option

Browse source 
Additionally, name all text size values so it doesn't happen again in the future.
This commit is contained in:
CTCaer 2020-01-17 09:22:28 +02:00
parent 2a161b572b
commit 8552a7282c
1 changed files with 27 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

49
bootloader/config/config.c
View file

@ -285,10 +285,11 @@ void config_autoboot()
LIST_INIT(ini_sections); LIST_INIT(ini_sections);
u8 max_entries = 30; u8 max_entries = 30;
u32 boot_text_size = 512;
ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * (max_entries + 5)); ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * (max_entries + 5));
u32 *boot_values = (u32 *)malloc(sizeof(u32) * max_entries); u32 *boot_values = (u32 *)malloc(sizeof(u32) * max_entries);
char *boot_text = (char *)malloc(512 * max_entries); char *boot_text = (char *)malloc(boot_text_size * max_entries);
for (u32 j = 0; j < max_entries; j++) for (u32 j = 0; j < max_entries; j++)
boot_values[j] = j; boot_values[j] = j;
@ -334,12 +335,12 @@ void config_autoboot()
else else
{ {
if (h_cfg.autoboot != (i - 4) || h_cfg.autoboot_list) if (h_cfg.autoboot != (i - 4) || h_cfg.autoboot_list)
boot_text[(i - 4) * 512] = ' '; boot_text[(i - 4) * boot_text_size] = ' ';
else else
boot_text[(i - 4) * 512] = '*'; boot_text[(i - 4) * boot_text_size] = '*';
strcpy(boot_text + (i - 4) * 512 + 1, ini_sec->name); strcpy(boot_text + (i - 4) * boot_text_size + 1, ini_sec->name);
ments[i].caption = &boot_text[(i - 4) * 512]; ments[i].caption = &boot_text[(i - 4) * boot_text_size];
} }
ments[i].type = ini_sec->type; ments[i].type = ini_sec->type;
ments[i].data = &boot_values[i - 4]; ments[i].data = &boot_values[i - 4];
@ -395,10 +396,11 @@ void config_bootdelay()
gfx_con_setpos(0, 0); gfx_con_setpos(0, 0);
u32 delay_entries = 6; u32 delay_entries = 6;
u32 delay_text_size = 32;
ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * (delay_entries + 3)); ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * (delay_entries + 3));
u32 *delay_values = (u32 *)malloc(sizeof(u32) * delay_entries); u32 *delay_values = (u32 *)malloc(sizeof(u32) * delay_entries);
char *delay_text = (char *)malloc(32 * delay_entries); char *delay_text = (char *)malloc(delay_text_size * delay_entries);
for (u32 j = 0; j < delay_entries; j++) for (u32 j = 0; j < delay_entries; j++)
delay_values[j] = j; delay_values[j] = j;
@ -419,14 +421,14 @@ void config_bootdelay()
for (i = 1; i < delay_entries; i++) for (i = 1; i < delay_entries; i++)
{ {
if (h_cfg.bootwait != i) if (h_cfg.bootwait != i)
delay_text[i * 32] = ' '; delay_text[i * delay_text_size] = ' ';
else else
delay_text[i * 32] = '*'; delay_text[i * delay_text_size] = '*';
delay_text[i * 32 + 1] = i + '0'; delay_text[i * delay_text_size + 1] = i + '0';
strcpy(delay_text + i * 32 + 2, " seconds"); strcpy(delay_text + i * delay_text_size + 2, " seconds");
ments[i + 2].type = MENT_DATA; ments[i + 2].type = MENT_DATA;
ments[i + 2].caption = delay_text + i * 32; ments[i + 2].caption = delay_text + (i * delay_text_size);
ments[i + 2].data = &delay_values[i]; ments[i + 2].data = &delay_values[i];
} }
@ -454,9 +456,11 @@ void config_verification()
gfx_clear_grey(0x1B); gfx_clear_grey(0x1B);
gfx_con_setpos(0, 0); gfx_con_setpos(0, 0);
u32 vr_text_size = 64;
ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * 6); ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * 6);
u32 *vr_values = (u32 *)malloc(sizeof(u32) * 3); u32 *vr_values = (u32 *)malloc(sizeof(u32) * 3);
char *vr_text = (char *)malloc(64 * 3); char *vr_text = (char *)malloc(vr_text_size * 3);
for (u32 j = 0; j < 3; j++) for (u32 j = 0; j < 3; j++)
{ {
@ -477,10 +481,10 @@ void config_verification()
for (u32 i = 0; i < 3; i++) for (u32 i = 0; i < 3; i++)
{ {
if (h_cfg.verification != i) if (h_cfg.verification != i)
vr_text[64 * i] = ' '; vr_text[vr_text_size * i] = ' ';
else else
vr_text[64 * i] = '*'; vr_text[vr_text_size * i] = '*';
ments[2 + i].caption = vr_text + (i * 64); ments[2 + i].caption = vr_text + (i * vr_text_size);
} }
memset(&ments[5], 0, sizeof(ment_t)); memset(&ments[5], 0, sizeof(ment_t));
@ -507,11 +511,12 @@ void config_backlight()
gfx_clear_grey(0x1B); gfx_clear_grey(0x1B);
gfx_con_setpos(0, 0); gfx_con_setpos(0, 0);
u32 bri_text_size = 8;
u32 bri_entries = 11; u32 bri_entries = 11;
ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * (bri_entries + 3)); ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * (bri_entries + 3));
u32 *bri_values = (u32 *)malloc(sizeof(u32) * bri_entries); u32 *bri_values = (u32 *)malloc(sizeof(u32) * bri_entries);
char *bri_text = (char *)malloc(8 * bri_entries); char *bri_text = (char *)malloc(bri_text_size * bri_entries);
for (u32 j = 1; j < bri_entries; j++) for (u32 j = 1; j < bri_entries; j++)
bri_values[j] = j * 10; bri_values[j] = j * 10;
@ -525,20 +530,20 @@ void config_backlight()
for (i = 1; i < bri_entries; i++) for (i = 1; i < bri_entries; i++)
{ {
if ((h_cfg.backlight / 20) != i) if ((h_cfg.backlight / 20) != i)
bri_text[i * 32] = ' '; bri_text[i * bri_text_size] = ' ';
else else
bri_text[i * 32] = '*'; bri_text[i * bri_text_size] = '*';
if (i < 10) if (i < 10)
{ {
bri_text[i * 32 + 1] = i + '0'; bri_text[i * bri_text_size + 1] = i + '0';
strcpy(bri_text + i * 32 + 2, "0%"); strcpy(bri_text + i * bri_text_size + 2, "0%");
} }
else else
strcpy(bri_text + i * 32 + 1, "100%"); strcpy(bri_text + i * bri_text_size + 1, "100%");
ments[i + 1].type = MENT_DATA; ments[i + 1].type = MENT_DATA;
ments[i + 1].caption = bri_text + i * 32; ments[i + 1].caption = bri_text + (i * bri_text_size);
ments[i + 1].data = &bri_values[i]; ments[i + 1].data = &bri_values[i];
} }