| Title | [lDOS] Overlong MCB name could overflow into process memory block |
|---|---|
| Author | E. C. Masloch |
| Created | 2026-06-08 21:05:53 +0200 Jun Mon |
| State | closed |
With a large enough name, this could overflow into the already
loaded program at PSP:100h. (The PSP is not corrupted by this
because it is set up later than the MCB name.)
Bug not present in MS-DOS v5.00, MS-DOS v7.10, FreeDOS, or Enhanced DR-DOS.
Test case as a Script for lDebug file, testname.sld:
(Needs uncaps.com
in current directory and writes to int12345.com)
k int12345.com
qa
a 100
int3
mov ax, 4C00
int 21
.
r bxcx := aao - 100
w 100
k uncaps.com int12345.com
bp at ptr ri21p when value ah in 4A, 4B
l
g
if (csip != ri21p || ah != 4A || es != psp) then goto :eof
r v0 := bx << 4
r bx += 20
g ptr [ss:sp]
if (fl.CF) then goto :eof
g
if (csip != ri21p || ah != 4B || ds != psp) then goto :eof
f psp:v0 l 109 90
e psp:v0 "int12345"
e psp:v0+108 90 ".com" 0
r dx v0
; Run g command now. Should break in int12345.com
Fixed in hg 24d626ddadd9 on 2025-09-22.