[DragonFlyBSD - Bug #3446] (In Progress) Boot loader hangs reading past a CD9660 directory

[liweitianux]

Issue #3446 has been updated by liweitianux.

Status changed from New to In Progress
Assignee set to liweitianux

@sigttou, I cross-checked the code in FreeBSD and found they chose a different fix, as reviewed at https://reviews.freebsd.org/D8101.

The final "cleaned" code is:

<pre><code class="c">
			dp = (struct iso_directory_record *)
				((char *) dp + isonum_711(dp->length));
			/* If the new block has zero length, it is padding. */
			if (isonum_711(dp->length) == 0) {
				/* Skip to next block, if any. */
				off = boff * ISO_DEFAULT_BLOCK_SIZE;
				continue;
			}
			off += isonum_711(dp->length);
</code></pre>

Should we follow their fix?

----------------------------------------
Bug #3446: Boot loader hangs reading past a CD9660 directory
http://bugs.dragonflybsd.org/issues/3446#change-14831

* Author: sigttou
* Status: In Progress
* Priority: Normal
* Assignee: liweitianux
* Category: installer
* Target version: 6.6
* Start date: 2026-10-11
----------------------------------------
The pc32 boot loader reads a DragonFly install ISO and hangs before the
kernel starts. There is no crash and no panic; it just spins. This
happens on a normal ISO.

@cd9660_open()@ in @stand/lib/cd9660.c@ walks a directory record by
record. It moves the record pointer @dp@ to the next record and only
then adds the record length to the byte counter @off at . Because @dp@ has
already moved, @off@ gets the next record's length, not the current
one.

On the ISO that was checked, @/boot/kernel@ ends with a single                                                                                                                                 @ZLIB.KO;1@ record and the next sector is the start of @aac.ko at . Its                                                                                                                           first byte @0x7f@ is read as a record length of 127 and its name-length                                                                                                                        byte is 0, so the scanner never advances and the loader hangs.


---Files--------------------------------
0001-cd9660-current-record-accounting.patch (1.5 KB)


-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account