Skip to content

Fix oversized D81 track initialization - #848

Merged
chrisgleissner merged 2 commits into
GideonZ:masterfrom
barryw:fix/d81-track-bounds
Sep 14, 2026
Merged

chrisgleissner merged 2 commits into
GideonZ:masterfrom
barryw:fix/d81-track-bounds

Conversation

@barryw

@barryw barryw commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

Summary

  • clamp MFM track initialization to the fixed 84-track arrays
  • add an ASan/UBSan regression test for 80, 81, 84, and oversized layouts
  • add a hardware E2E suite using generated 80-, 81-, and 85-track D81 images

Root cause

D81 track counts come from image size. An image containing more than 84 tracks made MfmDisk::init() index past its fixed side0 and side1 arrays, corrupting adjacent memory.

The bound is enforced once in MfmDisk::init(), covering every caller.

Verification

  • without the guard, the host regression test reports index 84 out of bounds and an ASan stack-buffer-overflow
  • with the guard, make d81_tracks_test passes under macOS Clang and Linux GCC
  • Ultimate 64 firmware builds and packages with Quartus 18.1
  • Ultimate 64 Elite hardware: all 10 generated-D81 checks pass, including the 85-track regression and exact 512-byte track-81 reads
  • full hardware gate executed: D81, UCI, filesystem, drive, Assembly64, key-injection, REU, freeze-menu, and device health checks pass without recovery

The E2E fixtures are generated during the test; no Wheels image is distributed.

Closes #846

@barryw
barryw force-pushed the fix/d81-track-bounds branch 2 times, most recently from ad6a75c to 932130c Compare September 4, 2026 19:50
D81 track counts are derived from file size. Values above the fixed 84-track arrays corrupt adjacent memory during layout initialization.

Clamp at the shared boundary and cover 80-, 81-, 84-, and oversized layouts with a sanitizer host test.

Closes GideonZ#846
Generate 80-, 81-, and 85-track fixtures, then verify physical track 81 through the emulated 1581 on real hardware.\n\nRefs GideonZ#846
@barryw
barryw force-pushed the fix/d81-track-bounds branch from 932130c to ed38f9d Compare September 4, 2026 19:54
@chrisgleissner chrisgleissner added 3.16 Targets 3.16 release bug labels Sep 9, 2026
@chrisgleissner
chrisgleissner changed the base branch from test-merge to master September 13, 2026 12:42
@chrisgleissner chrisgleissner added 3.15 and removed 3.16 Targets 3.16 release labels Sep 14, 2026
@chrisgleissner
chrisgleissner merged commit 82b0873 into GideonZ:master Sep 14, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Clamp D81 track count to prevent MfmDisk memory corruption

2 participants