Skip to content

Commit

Permalink
mkfs.fat: Fix upper limit for CHS overflow in MBR
Browse files Browse the repository at this point in the history
Maximal head value in MBR CHS is 255. But due to bug in MS-DOS which cause
system crash when head value in MBR CHS is 255, it is common to use only
maximal head value 254.

Head value in MBR CHS is zero indexed. So number of disk heads (stored in
FAT boot sector) is maximal head value in MBR CHS + 1.

So fix upper limit for number of heads to 255 which can be still
represented in MBR CHS without MS-DOS crash.
  • Loading branch information
pali committed Jun 12, 2021
1 parent d733fb0 commit f414e32
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions src/mkfs.fat.c
Original file line number Diff line number Diff line change
Expand Up @@ -1095,7 +1095,7 @@ static void setup_tables(void)
partition[3] = 0;

/* Partition type */
if (le16toh(bs.heads) > 254 || le16toh(bs.secs_track) > 63) { /* CHS values are out of range for MBR, use LBA */
if (le16toh(bs.heads) > 255 || le16toh(bs.secs_track) > 63) { /* CHS values are out of range for MBR, use LBA */
if (size_fat != 32)
partition[4] = 0x0E; /* BIG FAT16 (LBA) */
else
Expand All @@ -1112,7 +1112,7 @@ static void setup_tables(void)
partition[4] = 0x0C; /* FAT32 (LBA) */

/* CHS address of the last sector */
if (le16toh(bs.heads) > 254 || le16toh(bs.secs_track) > 63 || num_sectors >= le16toh(bs.secs_track) * le16toh(bs.heads) * 1024) {
if (le16toh(bs.heads) > 255 || le16toh(bs.secs_track) > 63 || num_sectors >= le16toh(bs.secs_track) * le16toh(bs.heads) * 1024) {
/* If CHS address is too large use tuple (1023, 254, 63) */
partition[5] = 254;
partition[6] = 255;
Expand Down

0 comments on commit f414e32

Please sign in to comment.