I completed the extraction from the old patch, the survival issues are in the new one in attachement which applies on the trunk. Here the changes: i) it is moved the safe check of SavePtr apart assigned() function from unnecessary ( RestoreState functions) to really necessary (freeSaveStateBuffer procedure);
ii) it is avoid a potential twice in deallocation of SavePtr in the RestoreStateVESA functions, I tested with
program exploit1;
uses graph;
var gd,gm,err:integer;
begin
gd:=d16bit;
gm:=m320x200;
initgraph(gd,gm,'');
err:=graphresult;
if errgrok then
begin
writeln(grapherrormsg(err));
halt;
end;
closegraph;
end.
although before and after never causes a rte216 as there's the check on SavePtr,
iii) it is passed the correct type in the Global_Dos_Free function, accordingly to the FPC manual,
iv) it is moved the initialization of SavePtr to the QueryAdapterInfo function to prevent error in the lack of the call of InitGraph, like in
program exploit2;
uses graph;
begin
closegraph;
end.
although before and after works for the automatic initialization of the compiler.
Greetings, Marco.
The following section of this message contains a file attachment prepared for transmission using the Internet MIME message format. If you are using Pegasus Mail, or any other MIME-compliant system, you should be able to save it or view it from within your mailer. If you cannot, please ask your system administrator for assistance.
---- File information -----------
File: graph.diff
Date: 12 Jun 2007, 15:04
Size: 4356 bytes.
Type: Unknown
