Bug 4283 - Fix potential overlap of VM stack and bss sections
Status: RESOLVED DUPLICATE of bug 4282
Alias: None
Product: ioquake3
Classification: Unclassified
Component: Platform
Version: GIT MASTER
Hardware: All All
: P3 normal
Assignee: Zachary J. Slater
QA Contact: ioquake3 bugzilla mailing list
URL:
Depends on:
Blocks:
 
Reported: 2009-09-15 04:18 EDT by Patrick Baggett
Modified: 2009-09-15 04:19:36 EDT
0 users

See Also:



Description Patrick Baggett 2009-09-15 04:18:06 EDT
It is possible for the Q3VM stack and data segment to overlap, which is very bad. Below is the write up that I made a long time ago and mentioned once on the mailing list but never filed a bug for:

Consulting vm.c:VM_LoadQVM()

If you see the definition of the "dataMask", you'll see it is the next highest power of two that is greater than the sum of data, lit, and bss segments. So, if the their sum was say, 400 bytes, then the next highest power of two would be 512, and the mask would be 0x1FF (decimal 511). Let's continue with this example. The stack grows down, and is implicity at the end of the image. This means that the 

[data+lit+bss = 400][Extra space 112 bytes]

^------------------------------------------^ Whole allocation is 512 bytes.


Let's suppose the stack size was 256 bytes. This means:

                Stack size of 256 bytes
             v---------------------------v
[data+lit+bss = 400][Extra space 112 bytes]
^------------------^
             [ !!! ]

The area marked as [ !!! ] is the overlap of the two.

This can easily be fixed by changing the calculation of "dataLength" in vm.c to:

dataLength = header.h->dataLength + header.h->litLength + header.h->bssLength + STACK_SIZE;



This has not yet been a problem, but the closer the sum (header.h->dataLength + header.h->litLength + header.h->bssLength) is to a power of two, the more likely the error is to occur.
Comment 1 Patrick Baggett 2009-09-15 04:19:36 EDT
sorry, double post

*** This bug has been marked as a duplicate of bug 4282 ***